Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:10
Static task
static1
Behavioral task
behavioral1
Sample
c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exe
Resource
win10v2004-20220812-en
General
-
Target
c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exe
-
Size
185KB
-
MD5
44538014670c0e5fade1a7b76d9f99b6
-
SHA1
407e6f8b13d5c03a28ad10f5e18182a922a7ebbd
-
SHA256
c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431
-
SHA512
db5a6c7bd7f6a9a953064fa1424513a024b62c3107d23194d12f81af6fa2b60e073ad1c22001b135d4bf88ab0d399b1e5f64a47ee796a986296f5854ded37ede
-
SSDEEP
3072:0GJ7kBLVLUam7WozO5BpugQbdiXx+xOXI1bq:PJ8LUam7bEhOUI
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/632-134-0x0000000002380000-0x0000000002389000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exepid process 632 c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exe 632 c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exe 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1040 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exepid process 632 c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exe"C:\Users\Admin\AppData\Local\Temp\c88f3b731984ada310840bdb984decbfe9d453a38a805a16d6502d03b975c431.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/632-133-0x0000000000650000-0x0000000000750000-memory.dmpFilesize
1024KB
-
memory/632-134-0x0000000002380000-0x0000000002389000-memory.dmpFilesize
36KB
-
memory/632-135-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB
-
memory/632-136-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB