Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2022 20:37
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
271KB
-
MD5
fc15332dd93a9c5f77466bc85a098c9d
-
SHA1
40a1e266db828c33d1ca4b350c5fddf51065017e
-
SHA256
5fb2a7b5cea517829f733b1bbdeca2baa30e84b138eb2f83224971e53b82fc8a
-
SHA512
d231120b99409b5688653642f543dec85f860517629aea49fe26947a644ea16efa0364a314460d253da99728444ef15a722972e091d918ee59cac8427d28f530
-
SSDEEP
6144:/7a4DhL5ar+O2CxERuzbgwuRFbNG/wVfUsk:/7bVardsunnK+3
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2548-133-0x00000000004D0000-0x00000000004D9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 2548 file.exe 2548 file.exe 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2416 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 2548 file.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2548-132-0x000000000052F000-0x0000000000540000-memory.dmpFilesize
68KB
-
memory/2548-133-0x00000000004D0000-0x00000000004D9000-memory.dmpFilesize
36KB
-
memory/2548-134-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2548-135-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB