Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
05/10/2022, 12:39
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target file.exe
- Size 279KB
- Sample221005-pvlldaeefr
- SHA256 8efce4e7e3c1a753e03a7726011103bcd54c1c27f41acc01a48a21c8bdf0eb63
- MD5 0deda5a40fdb8fd510f497b180d5026a
- SHA1 542c93dec52734061f6a8e54c3c3117d99fe807e
- SHA512 f599208b237d3c52d4b09ebe9a4b0b6c5f78375d39f0acc384591974e4c2d89bf6db6dbe4c6de6ca8efa932d56c13d73182b9684e894beaa185be65510200c6b
- SSDEEP 6144:s1hkqaLKKrv/zeHCdQoBojuzbgwumjpjwVfU:s1OqaVrvL2CNEunnBN5
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4632-133-0x00000000005A0000-0x00000000005A9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 5064 ctfevjg - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ctfevjg Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ctfevjg Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ctfevjg - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4632 file.exe 4632 file.exe 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2596 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4632 file.exe 5064 ctfevjg
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4632
-
C:\Users\Admin\AppData\Roaming\ctfevjgC:\Users\Admin\AppData\Roaming\ctfevjg1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5064
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\ctfevjg
- Size 279KB
- SHA256 8efce4e7e3c1a753e03a7726011103bcd54c1c27f41acc01a48a21c8bdf0eb63
- MD5 0deda5a40fdb8fd510f497b180d5026a
- SHA1 542c93dec52734061f6a8e54c3c3117d99fe807e
- SHA512 f599208b237d3c52d4b09ebe9a4b0b6c5f78375d39f0acc384591974e4c2d89bf6db6dbe4c6de6ca8efa932d56c13d73182b9684e894beaa185be65510200c6b
- SSDEEP 6144:s1hkqaLKKrv/zeHCdQoBojuzbgwumjpjwVfU:s1OqaVrvL2CNEunnBN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\ctfevjg
- Size 279KB
- SHA256 8efce4e7e3c1a753e03a7726011103bcd54c1c27f41acc01a48a21c8bdf0eb63
- MD5 0deda5a40fdb8fd510f497b180d5026a
- SHA1 542c93dec52734061f6a8e54c3c3117d99fe807e
- SHA512 f599208b237d3c52d4b09ebe9a4b0b6c5f78375d39f0acc384591974e4c2d89bf6db6dbe4c6de6ca8efa932d56c13d73182b9684e894beaa185be65510200c6b
- SSDEEP 6144:s1hkqaLKKrv/zeHCdQoBojuzbgwumjpjwVfU:s1OqaVrvL2CNEunnBN5
- MD5 SHA1 SHA512 SSDEEP