Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
10/10/2022, 12:27
Static task
static1
Behavioral task
behavioral1
Sample
0d02c15eef61b85f35823b1c37ee6b0b.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d02c15eef61b85f35823b1c37ee6b0b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 0d02c15eef61b85f35823b1c37ee6b0b.exe
- Size 276KB
- Sample221010-pmrgnacaaq
- SHA256 b625361a15c00ad25adfa2130dfa1033108cebad9705db647b64f4e43e3d8b46
- MD5 0d02c15eef61b85f35823b1c37ee6b0b
- SHA1 a480af11f34cb38dc11cc363d025d66743c2ba91
- SHA512 bf02349edb7ba6522c472e1bda077b8a311b61a92829bd56f99bfdfb91d29ccb8a4aa91332bb0d95d31d01a0cc4c0124ddb6e69b8a880ec2e13e049641f0d3c2
- SSDEEP 6144:QdD7MFE2x6O9Wy9kEZ/Ouo/t4hrwVfquS:Qd0FE2D9pks/OuoF4hd
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/1956-133-0x00000000005A0000-0x00000000005A9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0d02c15eef61b85f35823b1c37ee6b0b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0d02c15eef61b85f35823b1c37ee6b0b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0d02c15eef61b85f35823b1c37ee6b0b.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1956 0d02c15eef61b85f35823b1c37ee6b0b.exe 1956 0d02c15eef61b85f35823b1c37ee6b0b.exe 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found 512 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 512 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1956 0d02c15eef61b85f35823b1c37ee6b0b.exe