Analysis
- max time kernel
155s - max time network
49s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
17/10/2022, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
2799e835de7c35f0578c7ec497a20cf1.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
- Target 2799e835de7c35f0578c7ec497a20cf1.exe
- Size 214KB
- Sample221017-rel83scbgl
- SHA256 7f1162b133373aeaa422b0356992ffecbc1c9c4fa07afdc389fb8d62e040e152
- MD5 2799e835de7c35f0578c7ec497a20cf1
- SHA1 dc67f9b8eacba391d49581eb51287fe859832c68
- SHA512 9e6902d353e50c2dd0ff37b43feed64d7320f92273880264a9d4f96b3fa0f4871e408087dbfd874e4be7d3393a6680a1f55c5ce847b126c683300ea436b26866
- SSDEEP 3072:/R3Xpkg1LGFO6g5G3SRl5N7aOFDRDvhSX/hmAvazaQqGo0Kk+wY:Jn7LGFp3aZjDRGQ0QqGo0+wY
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1632-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2799e835de7c35f0578c7ec497a20cf1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2799e835de7c35f0578c7ec497a20cf1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2799e835de7c35f0578c7ec497a20cf1.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1632 2799e835de7c35f0578c7ec497a20cf1.exe 1632 2799e835de7c35f0578c7ec497a20cf1.exe 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1632 2799e835de7c35f0578c7ec497a20cf1.exe