Analysis
- max time kernel
150s - max time network
33s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system - submitted
17/11/2022, 12:32
Static task
static1
Behavioral task
behavioral1
Sample
3aeb8cff4ebe108c81f238c0c0609a41.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
General
- Target 3aeb8cff4ebe108c81f238c0c0609a41.exe
- Size 163KB
- Sample221117-pql2caed36
- SHA256 1193fb4fa844426c76ab4d206eff0daa52e04de6b8dae1e79504af205e273a11
- MD5 3aeb8cff4ebe108c81f238c0c0609a41
- SHA1 bb5dc719bdb5a0bed6847b3bb037ddad406dc988
- SHA512 96bcc3564f74b24b394abb759068ee4b07820ca8536d8104a63ae3db7d4f74f1f7832061b4e80e8ade70521b7eabff829e926b887734e5479be3c62ad8df2ca0
- SSDEEP 3072:vN+lWOd1S4sOrjt5IWLzj8Tf8PqJXRKXkeJCKF9/D:l623nWLzZSaF
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1080-56-0x00000000001B0000-0x00000000001B9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3aeb8cff4ebe108c81f238c0c0609a41.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3aeb8cff4ebe108c81f238c0c0609a41.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3aeb8cff4ebe108c81f238c0c0609a41.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1080 3aeb8cff4ebe108c81f238c0c0609a41.exe 1080 3aeb8cff4ebe108c81f238c0c0609a41.exe 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1372 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1080 3aeb8cff4ebe108c81f238c0c0609a41.exe