Analysis
- max time kernel
151s - max time network
45s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
04/11/2022, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
0ea81dcef3cc904eed9a70eac27437df.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ea81dcef3cc904eed9a70eac27437df.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 0ea81dcef3cc904eed9a70eac27437df.exe
- Size 303KB
- Sample221104-x5hapsacd8
- SHA256 8bb0c3620d088547fecab128c97aa368caeebb99a6e6055ef6b67970cf59110f
- MD5 0ea81dcef3cc904eed9a70eac27437df
- SHA1 53b7254b1d30dd2699cb047506dc09327cd845d3
- SHA512 b20ed4df7607734ba8340c2c3fa2f6105f456e2f58f54e6e91418170011c5043cf754b8d4cf4c60650c35ede7f98555ca77ac3cb125b194d0d45b2721293a9fc
- SSDEEP 3072:ObaTnDpnhxP5FiCcGuT/Exmpy1DkIn+rgpfN7RzT:MaTHBHcGuT/N84InXpVd
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1944-56-0x0000000000230000-0x0000000000239000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0ea81dcef3cc904eed9a70eac27437df.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0ea81dcef3cc904eed9a70eac27437df.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0ea81dcef3cc904eed9a70eac27437df.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1944 0ea81dcef3cc904eed9a70eac27437df.exe 1944 0ea81dcef3cc904eed9a70eac27437df.exe 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1944 0ea81dcef3cc904eed9a70eac27437df.exe