Analysis
- max time kernel
150s - max time network
46s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
10/11/2022, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
d68bd01a1c047679188bd4ba14268249.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
d68bd01a1c047679188bd4ba14268249.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
33 signatures
150 seconds
General
- Target d68bd01a1c047679188bd4ba14268249.exe
- Size 189KB
- Sample221110-h4x77shfdm
- SHA256 828a669fddc220845a2cbb3cfca3bf06f60b40fefe044cb627d50bb692d22c67
- MD5 d68bd01a1c047679188bd4ba14268249
- SHA1 1a3f1ecf879760071cdddc93695dc1980271b7e4
- SHA512 40e084b73c4e551687cce55cb49dbdf37c84a994f5422703a173c6838eb8359b33dbc26bad914b050b5c094eb3e80ff9b57993dd06f6c11259bf0ecee6315db5
- SSDEEP 3072:WyXWM7gh+t3gLorfzsWB7RXAVyuIMw9N1QLQ5Nhb:5WMuLmfzsWDAVyuNcL3F
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1048-56-0x00000000002A0000-0x00000000002A9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d68bd01a1c047679188bd4ba14268249.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d68bd01a1c047679188bd4ba14268249.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d68bd01a1c047679188bd4ba14268249.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1048 d68bd01a1c047679188bd4ba14268249.exe 1048 d68bd01a1c047679188bd4ba14268249.exe 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1048 d68bd01a1c047679188bd4ba14268249.exe