Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 08:10
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
186KB
-
MD5
6bb48134948ad77c616f959b2035376d
-
SHA1
87ee66e6fc4c722f982c9b496fdf986e91452cfd
-
SHA256
19f0cedb9b68a2722025a2328175ef8726ef6cbc90790c44dddc6c263deb1dc0
-
SHA512
3703826605017f26be12eaeadb5a3e86202522f91826500d9d96440ea3fa568704fe849cf484a83afb9ee2a0b45e64425a9e2a1fc59e97b27751d79f4a57106b
-
SSDEEP
3072:KBkAqUk8d2LiKXWyhD5AsCE7YCwIv7Y7CYRB4FOhO:dAtGLiKXBpaG7YbBqz
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5064-133-0x0000000002380000-0x0000000002389000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 5064 file.exe 5064 file.exe 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2720 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 5064 file.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5064-132-0x00000000007AD000-0x00000000007BE000-memory.dmpFilesize
68KB
-
memory/5064-133-0x0000000002380000-0x0000000002389000-memory.dmpFilesize
36KB
-
memory/5064-134-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB
-
memory/5064-135-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB