Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-10-2022 06:32
Static task
static1
Behavioral task
behavioral1
Sample
e9587e4408566dfbd0c4e097c20cc16f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e9587e4408566dfbd0c4e097c20cc16f.exe
Resource
win10v2004-20220812-en
General
-
Target
e9587e4408566dfbd0c4e097c20cc16f.exe
-
Size
229KB
-
MD5
e9587e4408566dfbd0c4e097c20cc16f
-
SHA1
e1ca3fbae3e65b6cad318cece7f36ef1a4c51e59
-
SHA256
0a8e4a85b3a9ce35fa5457ca317bacca22bd4bc7e86d416fe89713125ef34551
-
SHA512
8dc6a7d13f18e305730ee26bb6610b11d8bd09a82b51cbcf612b8a074ebcea51d042585663cfe4c1097a11ec77fb00905e4f1c9f1bc520f6a065eb99d8c0d8df
-
SSDEEP
6144:8jvLFr/oXcDoMfek1zMi+kyKsCuq6YCZnTl:8rBrAX1aeW9+IsCd6xJl
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/968-56-0x00000000001B0000-0x00000000001B9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e9587e4408566dfbd0c4e097c20cc16f.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e9587e4408566dfbd0c4e097c20cc16f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e9587e4408566dfbd0c4e097c20cc16f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e9587e4408566dfbd0c4e097c20cc16f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e9587e4408566dfbd0c4e097c20cc16f.exepid process 968 e9587e4408566dfbd0c4e097c20cc16f.exe 968 e9587e4408566dfbd0c4e097c20cc16f.exe 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 1384 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e9587e4408566dfbd0c4e097c20cc16f.exepid process 968 e9587e4408566dfbd0c4e097c20cc16f.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/968-54-0x0000000075921000-0x0000000075923000-memory.dmpFilesize
8KB
-
memory/968-56-0x00000000001B0000-0x00000000001B9000-memory.dmpFilesize
36KB
-
memory/968-55-0x0000000000289000-0x000000000029E000-memory.dmpFilesize
84KB
-
memory/968-57-0x0000000000400000-0x0000000002C27000-memory.dmpFilesize
40.2MB
-
memory/968-58-0x0000000000400000-0x0000000002C27000-memory.dmpFilesize
40.2MB