Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
26/10/2022, 08:51
Static task
static1
Behavioral task
behavioral1
Sample
89c51c51ebaf61e0c57a4c2c95f81a4c.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
89c51c51ebaf61e0c57a4c2c95f81a4c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 89c51c51ebaf61e0c57a4c2c95f81a4c.exe
- Size 223KB
- Sample221026-kr54dsfbe2
- SHA256 55fa5d745d7a6e918054d60e0bad21e4f49ff3af409f6bac57c5b16bd3f45b05
- MD5 89c51c51ebaf61e0c57a4c2c95f81a4c
- SHA1 853c1acfc52ce440f8f1b8464d01ff98c54fe39d
- SHA512 4e9fae7dd6e01ca7e44bdec429a610201926e705b9604e553cacfcc00feb9e6636cf2d948a907ff6ad4fa432d5859d69f6e83a71b751196760bdd67ada5b6320
- SSDEEP 3072:dnfno6LssyAS7KryL3/2aZO6u5C4vLGh9LoT5sea3du9nWsCdSI3OfUmp:dnfotsm7KuLTZOz4L2yeaNu9nyd/i
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4200-133-0x00000000005E0000-0x00000000005E9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 89c51c51ebaf61e0c57a4c2c95f81a4c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 89c51c51ebaf61e0c57a4c2c95f81a4c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 89c51c51ebaf61e0c57a4c2c95f81a4c.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4200 89c51c51ebaf61e0c57a4c2c95f81a4c.exe 4200 89c51c51ebaf61e0c57a4c2c95f81a4c.exe 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found 2824 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2824 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4200 89c51c51ebaf61e0c57a4c2c95f81a4c.exe