Analysis
- max time kernel
154s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
19/10/2022, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target file.exe
- Size 229KB
- Sample221019-11mleaafaj
- SHA256 8c9b8702dd7c7ac11c7a830e9d38d64157d8aa23f054e0a1c8478c6b0ea7df7c
- MD5 e292139b58de94b55d634bb071e90160
- SHA1 944bd92a9d129ac159233e07fddf4895074162b9
- SHA512 5f2d6e1690be40c9aa2292c331f4c9539014f4b6bc7574227dba6bac0cb472529fa26f0ac1fa6d7d76570017908d47b84adf5bcaecab5dbf181de3fd19156893
- SSDEEP 3072:IQ2Nkc/CeDC0lqswS5nL2MQEcWVrGgsQgn2ERKd3oGvwp3jXMPKh1q7Y7:IQG/lDbqvS9L/QEcs6QgnaZoGItjhLp
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/2276-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 1360 udsbrcv - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udsbrcv Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udsbrcv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udsbrcv - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2276 file.exe 2276 file.exe 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2276 file.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2276
-
C:\Users\Admin\AppData\Roaming\udsbrcvC:\Users\Admin\AppData\Roaming\udsbrcv1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1360
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\udsbrcv
- Size 229KB
- SHA256 8c9b8702dd7c7ac11c7a830e9d38d64157d8aa23f054e0a1c8478c6b0ea7df7c
- MD5 e292139b58de94b55d634bb071e90160
- SHA1 944bd92a9d129ac159233e07fddf4895074162b9
- SHA512 5f2d6e1690be40c9aa2292c331f4c9539014f4b6bc7574227dba6bac0cb472529fa26f0ac1fa6d7d76570017908d47b84adf5bcaecab5dbf181de3fd19156893
- SSDEEP 3072:IQ2Nkc/CeDC0lqswS5nL2MQEcWVrGgsQgn2ERKd3oGvwp3jXMPKh1q7Y7:IQG/lDbqvS9L/QEcs6QgnaZoGItjhLp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\udsbrcv
- Size 229KB
- SHA256 8c9b8702dd7c7ac11c7a830e9d38d64157d8aa23f054e0a1c8478c6b0ea7df7c
- MD5 e292139b58de94b55d634bb071e90160
- SHA1 944bd92a9d129ac159233e07fddf4895074162b9
- SHA512 5f2d6e1690be40c9aa2292c331f4c9539014f4b6bc7574227dba6bac0cb472529fa26f0ac1fa6d7d76570017908d47b84adf5bcaecab5dbf181de3fd19156893
- SSDEEP 3072:IQ2Nkc/CeDC0lqswS5nL2MQEcWVrGgsQgn2ERKd3oGvwp3jXMPKh1q7Y7:IQG/lDbqvS9L/QEcs6QgnaZoGItjhLp
- MD5 SHA1 SHA512 SSDEEP