Analysis
- max time kernel
150s - max time network
46s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
27/11/2022, 23:41
Static task
static1
Behavioral task
behavioral1
Sample
184a3631ac144ff0153342cd222affbafc98cb7774f85b9c4803a7efbcbdf00d.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
184a3631ac144ff0153342cd222affbafc98cb7774f85b9c4803a7efbcbdf00d.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
35 signatures
150 seconds
General
- Target 184a3631ac144ff0153342cd222affbafc98cb7774f85b9c4803a7efbcbdf00d.exe
- Size 167KB
- Sample221127-3plwvacg21
- SHA256 184a3631ac144ff0153342cd222affbafc98cb7774f85b9c4803a7efbcbdf00d
- MD5 2383d8e32271f2724a30707c0f865223
- SHA1 822106d371b657e6b37115bcbe256df70930aacf
- SHA512 86fe1ebe61323ba8c64916a6aecc10bc57b3be156da8d29ada0774d123a4d431eacdfd39dce863b77767806fa4146b8b630fb749eff9341cf410866910fef6c4
- SSDEEP 3072:9M9IPFUzFUulC8S5wHeNgZ2EQzuyysaoXy:sI9uemCYZ2Jys6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1784-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 184a3631ac144ff0153342cd222affbafc98cb7774f85b9c4803a7efbcbdf00d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 184a3631ac144ff0153342cd222affbafc98cb7774f85b9c4803a7efbcbdf00d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 184a3631ac144ff0153342cd222affbafc98cb7774f85b9c4803a7efbcbdf00d.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1784 184a3631ac144ff0153342cd222affbafc98cb7774f85b9c4803a7efbcbdf00d.exe 1784 184a3631ac144ff0153342cd222affbafc98cb7774f85b9c4803a7efbcbdf00d.exe 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1784 184a3631ac144ff0153342cd222affbafc98cb7774f85b9c4803a7efbcbdf00d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\184a3631ac144ff0153342cd222affbafc98cb7774f85b9c4803a7efbcbdf00d.exe"C:\Users\Admin\AppData\Local\Temp\184a3631ac144ff0153342cd222affbafc98cb7774f85b9c4803a7efbcbdf00d.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1784