Analysis
- max time kernel
151s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
10/10/2022, 07:11
Static task
static1
Behavioral task
behavioral1
Sample
745b14fa0171cb190f66dbff6d8a083f.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
745b14fa0171cb190f66dbff6d8a083f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 745b14fa0171cb190f66dbff6d8a083f.exe
- Size 269KB
- Sample221010-hzx2msbbek
- SHA256 d35d51ee4b5fdac26fe5c8202db6683eeabaf2cbbf0567be5065a7db18d571a8
- MD5 745b14fa0171cb190f66dbff6d8a083f
- SHA1 4db93a1b6d020fc75a7a77f5701082550f4e3054
- SHA512 971f6d645a729cfb7c9003b70af74730d62d974139879c133cfc4e5d3bd8c778946e62e6b6b28705f45755049c3a220005b875ffc9e5b7cdf37a1a833807ebe0
- SSDEEP 3072:48XJtwgLqEIC4k1PcZUQv5Zo5bdFFs09a9FF14q/XnawJzkuwRT/pYvm6kM/h3qS:44ZLqXcQTo5bdk09aDfDkX6krwVfquS
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4928-133-0x0000000000510000-0x0000000000519000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 745b14fa0171cb190f66dbff6d8a083f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 745b14fa0171cb190f66dbff6d8a083f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 745b14fa0171cb190f66dbff6d8a083f.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4928 745b14fa0171cb190f66dbff6d8a083f.exe 4928 745b14fa0171cb190f66dbff6d8a083f.exe 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1996 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4928 745b14fa0171cb190f66dbff6d8a083f.exe