Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-11-2022 16:23
Static task
static1
Behavioral task
behavioral1
Sample
343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exe
Resource
win10v2004-20220812-en
General
-
Target
343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exe
-
Size
174KB
-
MD5
f5c178148b3caf9df80d0ebdad21247f
-
SHA1
ff30214f2095dc71308dac946fe15e087cfd6e14
-
SHA256
343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00
-
SHA512
d6514b82e3c37762379a795df9abc843c58854480fab34d7cdb311f808b2c62ef9f8b7b00673bce54254915d6ceb9ce4635d112f2ef591cdebe43535a6c98a0b
-
SSDEEP
3072:c9MHdH9ELRw1N2r/zRuJKmRXojVnGYK9cwLAJZFziYY:r8LRw1N2LxmhkVGYK9XLiZFz
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1392-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exepid process 1392 343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exe 1392 343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exe 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exepid process 1392 343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exe"C:\Users\Admin\AppData\Local\Temp\343ad489a8b48de4c33891a0f4e2772a8b969d0b12ec8a9b0808d1887443cc00.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1392-54-0x0000000075521000-0x0000000075523000-memory.dmpFilesize
8KB
-
memory/1392-55-0x000000000067B000-0x000000000068C000-memory.dmpFilesize
68KB
-
memory/1392-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1392-57-0x0000000000400000-0x0000000000587000-memory.dmpFilesize
1.5MB
-
memory/1392-58-0x0000000000400000-0x0000000000587000-memory.dmpFilesize
1.5MB