Analysis
-
max time kernel
150s -
max time network
68s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
-
submitted
06/11/2022, 12:05
General
-
Target
aa70786992be553b0e51e5bc98c1ad2d60b3c99bd1e16493648593123a9cdc88.exe
-
Size
285KB
-
MD5
aa2c8fe55e1902026dd62ae5080685a8
-
SHA1
60be5aa666e26e9de0ee6dcbea45d0612e12f8c9
-
SHA256
aa70786992be553b0e51e5bc98c1ad2d60b3c99bd1e16493648593123a9cdc88
-
SHA512
8d6cd4e4734d59bc51a3a786831c9fceae9ceb7c2505ec8c04eb41e062d65ed09e55ad231fb61907ff6b5bd0efc1e6a5d3a83c2720f85b46b6778b8f8c214b78
-
SSDEEP
3072:KqZ5WYin2CHThT5bqhRjywexBkuKUNg8MgY3IMjK/Yl:7Vi5H9tIexBkuJNg8MpHW/Yl
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa70786992be553b0e51e5bc98c1ad2d60b3c99bd1e16493648593123a9cdc88.exe"C:\Users\Admin\AppData\Local\Temp\aa70786992be553b0e51e5bc98c1ad2d60b3c99bd1e16493648593123a9cdc88.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\chescigC:\Users\Admin\AppData\Roaming\chescig1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
285KB
MD5aa2c8fe55e1902026dd62ae5080685a8
SHA160be5aa666e26e9de0ee6dcbea45d0612e12f8c9
SHA256aa70786992be553b0e51e5bc98c1ad2d60b3c99bd1e16493648593123a9cdc88
SHA5128d6cd4e4734d59bc51a3a786831c9fceae9ceb7c2505ec8c04eb41e062d65ed09e55ad231fb61907ff6b5bd0efc1e6a5d3a83c2720f85b46b6778b8f8c214b78
-
Filesize
285KB
MD5aa2c8fe55e1902026dd62ae5080685a8
SHA160be5aa666e26e9de0ee6dcbea45d0612e12f8c9
SHA256aa70786992be553b0e51e5bc98c1ad2d60b3c99bd1e16493648593123a9cdc88
SHA5128d6cd4e4734d59bc51a3a786831c9fceae9ceb7c2505ec8c04eb41e062d65ed09e55ad231fb61907ff6b5bd0efc1e6a5d3a83c2720f85b46b6778b8f8c214b78
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
88KB
-
Filesize
36KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4.3MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4.3MB
-
Filesize
696KB
-
Filesize
84KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4.3MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB