Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
28/10/2022, 06:39
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target file.exe
- Size 268KB
- Sample221028-hel4msege2
- SHA256 476eee19ed8c422727d9900fb5065ce206e8dcebd9b2a08c57f6b1af8a2cfb1e
- MD5 a2b2d82960423b0ea00a66902c7b29ea
- SHA1 d8a0723546521404f2b179027230cd20c4424792
- SHA512 2ecf094997dbb161268347509aad962dd387e15421f82e15b34dc2281d357c87d4eb50d3127ba8c9280a9bbcc3b7c35e24ffc9b233888683312f3d0914b8ebbd
- SSDEEP 6144:CrLHSLW8lx7ouLgTUfZZZI9aVVWrPC6j:CrLHSyKxMuLgTUfZZZea6m6j
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/896-133-0x0000000002D80000-0x0000000002D89000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 320 bfhdswb - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bfhdswb Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bfhdswb Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bfhdswb - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 896 file.exe 896 file.exe 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2484 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 896 file.exe 320 bfhdswb
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:896
-
C:\Users\Admin\AppData\Roaming\bfhdswbC:\Users\Admin\AppData\Roaming\bfhdswb1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:320
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\bfhdswb
- Size 268KB
- SHA256 476eee19ed8c422727d9900fb5065ce206e8dcebd9b2a08c57f6b1af8a2cfb1e
- MD5 a2b2d82960423b0ea00a66902c7b29ea
- SHA1 d8a0723546521404f2b179027230cd20c4424792
- SHA512 2ecf094997dbb161268347509aad962dd387e15421f82e15b34dc2281d357c87d4eb50d3127ba8c9280a9bbcc3b7c35e24ffc9b233888683312f3d0914b8ebbd
- SSDEEP 6144:CrLHSLW8lx7ouLgTUfZZZI9aVVWrPC6j:CrLHSyKxMuLgTUfZZZea6m6j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\bfhdswb
- Size 268KB
- SHA256 476eee19ed8c422727d9900fb5065ce206e8dcebd9b2a08c57f6b1af8a2cfb1e
- MD5 a2b2d82960423b0ea00a66902c7b29ea
- SHA1 d8a0723546521404f2b179027230cd20c4424792
- SHA512 2ecf094997dbb161268347509aad962dd387e15421f82e15b34dc2281d357c87d4eb50d3127ba8c9280a9bbcc3b7c35e24ffc9b233888683312f3d0914b8ebbd
- SSDEEP 6144:CrLHSLW8lx7ouLgTUfZZZI9aVVWrPC6j:CrLHSyKxMuLgTUfZZZea6m6j
- MD5 SHA1 SHA512 SSDEEP