Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
31/10/2022, 22:03
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
djvuredlinesmokeloadermario23_10backdoorcollectiondiscoveryinfostealerpersistenceransomwarespywarestealertrojan
34 signatures
150 seconds
General
-
Target
file.exe
-
Size
211KB
-
MD5
1c2cbe4fd8fdf6bfc328bfd771aec0a0
-
SHA1
ac856d3a08a190c65597d1bcbc4aeb879ac0f43c
-
SHA256
392590926787c60698fb55e152b0d66d575e466d9a5c1a246faeb4d495ccae35
-
SHA512
09fc57586ca1625a325e7eba88225d16f4cca59d727113fdd074a48781b9902b90a1a28ae34cde35f6a5e876a81e91cf27a3903a9abdf9d904b70d98c0c8ed04
-
SSDEEP
3072:1RLMeu6YSAAuTiurLL864c6Uf564JoOwto6N9Eq3Pd9Ckwx:1R4IYzAummLQRcDJhi9EI4L
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/536-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 536 file.exe 536 file.exe 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 536 file.exe