Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-10-2022 00:21
Static task
static1
Behavioral task
behavioral1
Sample
826aa9234de38f7df9471a96123353f3.exe
Resource
win7-20220812-en
General
-
Target
826aa9234de38f7df9471a96123353f3.exe
-
Size
219KB
-
MD5
826aa9234de38f7df9471a96123353f3
-
SHA1
45385e79156656d8e78002241afb6c54f34d3c00
-
SHA256
67076dd399a7a1ba3f6218f67b6241100241d51c5d8b9d79bec7631db0fe3aff
-
SHA512
a62ba58c4de2e6a8e515e8a9f2271770a39ad9c9b35c2b593f85652aade60d2bc390ec5edf9053c437b79d1675fb03791d048c5ad06f432e673cb2b38b2d5456
-
SSDEEP
3072:+ln05dgYTAGSoLODwl625PJyIkn7Vwe82D/neLO2S4zxAc983Nwhh4X/Ts:+l00EL/lgn7VwexD/eAQxmShh
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1980-57-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
826aa9234de38f7df9471a96123353f3.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 826aa9234de38f7df9471a96123353f3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 826aa9234de38f7df9471a96123353f3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 826aa9234de38f7df9471a96123353f3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
826aa9234de38f7df9471a96123353f3.exepid process 1980 826aa9234de38f7df9471a96123353f3.exe 1980 826aa9234de38f7df9471a96123353f3.exe 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
826aa9234de38f7df9471a96123353f3.exepid process 1980 826aa9234de38f7df9471a96123353f3.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1980-54-0x00000000006D8000-0x00000000006E9000-memory.dmpFilesize
68KB
-
memory/1980-55-0x0000000076031000-0x0000000076033000-memory.dmpFilesize
8KB
-
memory/1980-57-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1980-56-0x00000000006D8000-0x00000000006E9000-memory.dmpFilesize
68KB
-
memory/1980-58-0x0000000000400000-0x0000000000594000-memory.dmpFilesize
1.6MB
-
memory/1980-59-0x0000000000400000-0x0000000000594000-memory.dmpFilesize
1.6MB