Analysis
-
max time kernel
150s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 20:51
Static task
static1
Behavioral task
behavioral1
Sample
385d1771a7dc17eb225bd66206532548.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
385d1771a7dc17eb225bd66206532548.exe
Resource
win10v2004-20220901-en
General
-
Target
385d1771a7dc17eb225bd66206532548.exe
-
Size
274KB
-
MD5
385d1771a7dc17eb225bd66206532548
-
SHA1
f8d638a3f0dbbf458dc6fdbd0690bb55088e7f07
-
SHA256
0189e947ce0fdc72829aa217ddd7f19e2bf0b9e06187da7b3fd547ad0c57afe6
-
SHA512
6565c668f9b2cde8fe85e76405d6a7826ee020a2b4df12e39dd90700764e623d4224d5ef56a373dff2e654c4d749e6595e7e3fee0ed78494bfab8de3fcd3e0c4
-
SSDEEP
3072:B6pLHYtWsoS5dy1/BBBA2h0ZBrTMK0STAMmJaXFAm0HS54wLRntzvg49JFQvt:wpLHqoGaBOBsK5T/fXFA/qVFvg4/FQF
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1516-56-0x0000000000020000-0x0000000000029000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
385d1771a7dc17eb225bd66206532548.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 385d1771a7dc17eb225bd66206532548.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 385d1771a7dc17eb225bd66206532548.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 385d1771a7dc17eb225bd66206532548.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
385d1771a7dc17eb225bd66206532548.exepid process 1516 385d1771a7dc17eb225bd66206532548.exe 1516 385d1771a7dc17eb225bd66206532548.exe 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
385d1771a7dc17eb225bd66206532548.exepid process 1516 385d1771a7dc17eb225bd66206532548.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1516-54-0x0000000075841000-0x0000000075843000-memory.dmpFilesize
8KB
-
memory/1516-55-0x000000000028A000-0x000000000029F000-memory.dmpFilesize
84KB
-
memory/1516-56-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/1516-57-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1516-58-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB