Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
23-11-2022 10:06
Static task
static1
Behavioral task
behavioral1
Sample
3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exe
Resource
win10-20220812-en
General
-
Target
3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exe
-
Size
185KB
-
MD5
263cd8df6bac6e35c2fd10b61d44d7a3
-
SHA1
4e3c677904ca5d96e61a7bfd3aea31c98964af50
-
SHA256
3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb
-
SHA512
7d6e03bbcc60eb1ec1088aea709f766ee806e6f793319669c92a5ec966a0efc0217b5a05d964fccbed7e3ac1f07cffd9dec79e0d661b95b1e2ef1ca03052e086
-
SSDEEP
3072:ElBJn99H1zcLmPZWAulD65N3v4/JXiWIw6fDgDMTlTlmOFmDS:UnFgLmPZbui34awMDgmlEMd
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3844-145-0x0000000002360000-0x0000000002369000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2836 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exepid process 3844 3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exe 3844 3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exe 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 2836 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2836 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exepid process 3844 3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exe"C:\Users\Admin\AppData\Local\Temp\3886b293db6254deffd11144d220bb8007676fd1306f5e517dcafb297cec71cb.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3844-115-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-116-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-117-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-118-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-119-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-120-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-121-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-122-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-123-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-124-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-125-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-126-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-127-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-128-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-129-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-130-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-131-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-132-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-133-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-134-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-135-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-136-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-138-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-139-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-140-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-141-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-142-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-143-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-144-0x00000000006A0000-0x000000000074E000-memory.dmpFilesize
696KB
-
memory/3844-146-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-147-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB
-
memory/3844-145-0x0000000002360000-0x0000000002369000-memory.dmpFilesize
36KB
-
memory/3844-148-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-149-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-150-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-151-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3844-152-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB