Analysis
- max time kernel
150s - max time network
49s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system - submitted
22/10/2022, 04:21
Static task
static1
Behavioral task
behavioral1
Sample
e15b2ebd158ad84daf45b0853a1bfd3e.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
e15b2ebd158ad84daf45b0853a1bfd3e.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
32 signatures
150 seconds
General
- Target e15b2ebd158ad84daf45b0853a1bfd3e.exe
- Size 228KB
- Sample221022-eyn6kaafhn
- SHA256 a456d6716e60ae16123bd71757b572363050397586b8faf492648a886ab158e6
- MD5 e15b2ebd158ad84daf45b0853a1bfd3e
- SHA1 82e9555065e8b67ca93b4ae8bf35e717e400a9e3
- SHA512 efa035b6fa440b2dd347e3e05e99147db1df68f90be9226b35d0623b217da17bd0013c30000dee2710b2a99305bdc5fdaa3da877240b04547608442690dda45a
- SSDEEP 3072:ZXGahLBIzxYEr5j3k6dLw4NvxckxZQAXmJb6iQH0tm5h6S:95hLBixYE13kP4NL22xUS
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/2032-57-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e15b2ebd158ad84daf45b0853a1bfd3e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e15b2ebd158ad84daf45b0853a1bfd3e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e15b2ebd158ad84daf45b0853a1bfd3e.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2032 e15b2ebd158ad84daf45b0853a1bfd3e.exe 2032 e15b2ebd158ad84daf45b0853a1bfd3e.exe 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1368 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2032 e15b2ebd158ad84daf45b0853a1bfd3e.exe