Analysis

  • max time kernel
    151s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 16:38

General

  • Target

    lab.exe

  • Size

    186KB

  • MD5

    746bacf7a1977e9cd4228989a0287862

  • SHA1

    ef4785397069ec19c0f7e60771a51d1949b05ea6

  • SHA256

    9251e4d0d3f92f96f9484dc240ad5aecd74cd4ebe709fa609c60e6973057e28d

  • SHA512

    e36bf1ef8e5c5a5ca0c7d7b8c3d9a2ff0f08dfaa042e8ea9ea81fba8352d592095d9373e3189a7cfc2ca13b326ded7f98383fe93d8f2c86d87216324c1da6217

  • SSDEEP

    3072:eAsKG2vHpIrSWqLGd/+YlGB5kOcFKgHmqVC/64VykD9nDBE71MnT55P:KKAzqLGd/+85FKc+JBE76nTD

Malware Config

Signatures

  • Detects Smokeloader packer 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\lab.exe
    "C:\Users\Admin\AppData\Local\Temp\lab.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:620
    • C:\Users\Admin\AppData\Local\Temp\lab.exe
      "C:\Users\Admin\AppData\Local\Temp\lab.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1708

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/620-58-0x0000000000220000-0x0000000000229000-memory.dmp

    Filesize

    36KB

  • memory/620-56-0x00000000006FB000-0x000000000070C000-memory.dmp

    Filesize

    68KB

  • memory/1708-54-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1708-55-0x0000000000402DD8-mapping.dmp

  • memory/1708-57-0x0000000075711000-0x0000000075713000-memory.dmp

    Filesize

    8KB

  • memory/1708-59-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1708-60-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB