Analysis
- max time kernel
150s - max time network
49s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system - submitted
19/10/2022, 08:57
Static task
static1
Behavioral task
behavioral1
Sample
f0149c9ea100717e68500147965ca312.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
General
- Target f0149c9ea100717e68500147965ca312.exe
- Size 204KB
- Sample221019-kwlkjsffgn
- SHA256 b2f68f4bc4b9e4928c1563c0cce8f0551060ea1e301194b1f27689d8fcd62f61
- MD5 f0149c9ea100717e68500147965ca312
- SHA1 0f163f5e6e81932d7dd6f0bb0d31135fe2cb4d2f
- SHA512 7727e410c462a75e1d95eedab364a7ec1d69e200d83b2c468ba9b37c60f2d0725ce1a2446746232cc8d67a95cae8cdad542226d1dbecaa6bc83aac1d192de735
- SSDEEP 3072:eXGr1tLWRFyb3Q6y5Uah0w/4TdqcUtRk0Kg/bBpUn2UuSC:mC1tLqyb3Bf+YTUcUti0XbTaPuS
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1368-56-0x00000000001B0000-0x00000000001B9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f0149c9ea100717e68500147965ca312.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f0149c9ea100717e68500147965ca312.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f0149c9ea100717e68500147965ca312.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1368 f0149c9ea100717e68500147965ca312.exe 1368 f0149c9ea100717e68500147965ca312.exe 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found 1280 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1280 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1368 f0149c9ea100717e68500147965ca312.exe