Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-10-2022 00:03
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
General
-
Target
file.exe
-
Size
145KB
-
MD5
e2722c9b78abce4fd7d5979349041b2c
-
SHA1
3c514162739bad8a9b414cfb401b3715918ddc60
-
SHA256
ee43d7905e6761b168955f4cb672af00f7e0a1506f2baa5fb8170836ef5c82aa
-
SHA512
41c9937ca5a0635076737125f636513ce15f5442e0f90be8cb9bf2e4b133dd1b472c945ce497a7231b293c44c4d5d768a286915caca4c38139407450c02dc3fa
-
SSDEEP
3072:/gUWocfhfbL1TTHyXGB61AwrWQTlnRbdIpoGSJwO:4ewL13yWYAwrWml7IpoGSJw
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/240-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 240 file.exe 240 file.exe 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 1432 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 240 file.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/240-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmpFilesize
8KB
-
memory/240-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/240-55-0x00000000009DB000-0x00000000009EB000-memory.dmpFilesize
64KB
-
memory/240-57-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB
-
memory/240-58-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB