Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-10-2022 13:10
Static task
static1
Behavioral task
behavioral1
Sample
d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exe
Resource
win7-20220812-en
General
-
Target
d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exe
-
Size
283KB
-
MD5
7dc6a27f93470994c23ce9003c912675
-
SHA1
4a544e1d3883d36f28e5a738eb9b0f12838d0871
-
SHA256
d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771
-
SHA512
fe2d91f04c09ff4686f365ea858c937fc378e80aee022ae5a78ec4f90778821a1a94ded7dffe302d0a9cbb94d4f6ece785cb3f5b4b98fb558747d6c47fa3f858
-
SSDEEP
6144:zLgm4lPaVo3DRxnUm9Rb42ORM1FsYLbuEdInatp+VY/ivHS1j9V:zl4wVo3dBP9Rb42ORM1FpbuEdIOp+K+i
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2012-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exepid process 2012 d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exe 2012 d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exe 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exepid process 2012 d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exe"C:\Users\Admin\AppData\Local\Temp\d8287455999f2aad069146c6a014ae9b7812eb391bb003d819c9dc683b5cf771.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2012-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/2012-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2012-55-0x0000000000A1B000-0x0000000000A2C000-memory.dmpFilesize
68KB
-
memory/2012-57-0x0000000000400000-0x0000000000849000-memory.dmpFilesize
4.3MB
-
memory/2012-58-0x0000000000400000-0x0000000000849000-memory.dmpFilesize
4.3MB