Analysis
-
max time kernel
151s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-10-2022 23:39
Static task
static1
Behavioral task
behavioral1
Sample
D1B8AB6CCABE495CE293804A21D22FD820334E49E8D51.exe
Resource
win7-20220812-en
General
-
Target
D1B8AB6CCABE495CE293804A21D22FD820334E49E8D51.exe
-
Size
301KB
-
MD5
868d713b773d3812ed720b49e0b25de3
-
SHA1
3aab506746537e9f0d4cb39a40a8991251e0543e
-
SHA256
d1b8ab6ccabe495ce293804a21d22fd820334e49e8d51678bb814a3da93b6cab
-
SHA512
4b098286d545bacf1a5c9622c3fe5ae2163bff675ca333625b2fff66260c48e92f38644d3f44ab0b5875c9ad23aa158383ba00367b6639bb2cc46777f7c55ba7
-
SSDEEP
3072:MZXt4TNyHthtX5zXmm8C2RcDTTu1y7ih8WVt4I8Pa0KFrB7JNzM/h3BsxkgaBChj:UtuabzPTTu02nqPa0OznigabwVfv
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
D1B8AB6CCABE495CE293804A21D22FD820334E49E8D51.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D1B8AB6CCABE495CE293804A21D22FD820334E49E8D51.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D1B8AB6CCABE495CE293804A21D22FD820334E49E8D51.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D1B8AB6CCABE495CE293804A21D22FD820334E49E8D51.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
D1B8AB6CCABE495CE293804A21D22FD820334E49E8D51.exepid process 1968 D1B8AB6CCABE495CE293804A21D22FD820334E49E8D51.exe 1968 D1B8AB6CCABE495CE293804A21D22FD820334E49E8D51.exe 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
D1B8AB6CCABE495CE293804A21D22FD820334E49E8D51.exepid process 1968 D1B8AB6CCABE495CE293804A21D22FD820334E49E8D51.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1968-54-0x0000000076141000-0x0000000076143000-memory.dmpFilesize
8KB
-
memory/1968-55-0x00000000005FB000-0x000000000060C000-memory.dmpFilesize
68KB
-
memory/1968-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1968-57-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1968-58-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB