Analysis
- max time kernel
166s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
28/10/2022, 17:32
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target file.exe
- Size 260KB
- Sample221028-v397lagdf8
- SHA256 e8ef433038b2b91197b4f616ecdfd5a8abd699df6d0e806c376c5ae249923757
- MD5 bf801c2fb909f3ce58ba2e04466b55c6
- SHA1 618dc594de3e3790ab8d316fa276a3ca2e560231
- SHA512 2e2d1c3a36af18c39679d2f3a34ee73f410e9de800e3a86d9fe9ee6473c1f0d7e9706663294b798f39d9a472e92ad9e231488b325d8157d7dd58f229e7b49b16
- SSDEEP 3072:tXOFXHhNLqyAc+8XGNmj57fZYm6NL7IhvHkT1yW0+IJGCW/qGzT9mc5M/h3i:pSXHDLqD8WNkxYms72knqGfj9mc5
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 2 IoCs
resource yara_rule behavioral2/memory/4112-133-0x0000000003080000-0x0000000003089000-memory.dmp family_smokeloader behavioral2/memory/4112-136-0x0000000003080000-0x0000000003089000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4112 file.exe 4112 file.exe 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found 2016 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2016 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4112 file.exe