Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
17-11-2022 14:21
Static task
static1
Behavioral task
behavioral1
Sample
5d223480059a407288d6d863c890e646.exe
Resource
win7-20221111-en
6 signatures
150 seconds
General
-
Target
5d223480059a407288d6d863c890e646.exe
-
Size
163KB
-
MD5
5d223480059a407288d6d863c890e646
-
SHA1
24eb08599a9eda881d7e40f587c9c3a473a3272b
-
SHA256
19fd30ad2f4681647fd2306b27cf65cc1ac0d636b32bbe493499adeb89b57049
-
SHA512
f29c5c985e26b9334cf4f5900e456642905f37af5b40956d4169a5f01b3ed7cc5b416f8b0aeb30ee537d85c48318e5cc069e8d7546cf67a97c680ccec80de116
-
SSDEEP
3072:bZsxcqvI6oeNc5rbk1hpTzgm3/exCaIL9V46KvD:bSccPotk1LTEoy3IL9U
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/948-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
5d223480059a407288d6d863c890e646.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5d223480059a407288d6d863c890e646.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5d223480059a407288d6d863c890e646.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5d223480059a407288d6d863c890e646.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5d223480059a407288d6d863c890e646.exepid process 948 5d223480059a407288d6d863c890e646.exe 948 5d223480059a407288d6d863c890e646.exe 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1248 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
5d223480059a407288d6d863c890e646.exepid process 948 5d223480059a407288d6d863c890e646.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-54-0x0000000076691000-0x0000000076693000-memory.dmpFilesize
8KB
-
memory/948-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/948-55-0x00000000006BB000-0x00000000006CC000-memory.dmpFilesize
68KB
-
memory/948-57-0x0000000000400000-0x000000000058E000-memory.dmpFilesize
1.6MB
-
memory/948-58-0x0000000000400000-0x000000000058E000-memory.dmpFilesize
1.6MB
-
memory/1248-59-0x000007FEF6A20000-0x000007FEF6B63000-memory.dmpFilesize
1.3MB
-
memory/1248-60-0x000007FF52EB0000-0x000007FF52EBA000-memory.dmpFilesize
40KB