Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 07:19
Static task
static1
Behavioral task
behavioral1
Sample
e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exe
Resource
win10v2004-20221111-en
General
-
Target
e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exe
-
Size
186KB
-
MD5
5c60e20b49c5e18ef1d0dcc381981d8d
-
SHA1
fb1f6a807c1528c0ff7a57335eab0a5fb2ef4338
-
SHA256
e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885
-
SHA512
2934b7da7050768301af20892190a0cac1cd4270e9dde64917172e372c06dd2f1e29b329b029570aafd93193df7f6e2351ccbbf4b429c250584eb910ba74d63c
-
SSDEEP
3072:eBkA2r0cmsoLNtnWodD5iQwJFydSMvLH1f0UJvORBkGm8F5zfzpfIK:xAe0tLNtn7165MBtg4Ezp
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3488-133-0x0000000002930000-0x0000000002939000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exepid process 3488 e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exe 3488 e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exe 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 2584 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2584 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exepid process 3488 e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exe"C:\Users\Admin\AppData\Local\Temp\e4871ca5dbb69d477177de716f3ebc629ebd7a089810b7c689a887a9f0776885.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3488-132-0x0000000002A3D000-0x0000000002A4E000-memory.dmpFilesize
68KB
-
memory/3488-133-0x0000000002930000-0x0000000002939000-memory.dmpFilesize
36KB
-
memory/3488-134-0x0000000000400000-0x00000000027E8000-memory.dmpFilesize
35.9MB
-
memory/3488-135-0x0000000000400000-0x00000000027E8000-memory.dmpFilesize
35.9MB