Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 22:19
Static task
static1
Behavioral task
behavioral1
Sample
78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exe
Resource
win10v2004-20220812-en
General
-
Target
78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exe
-
Size
146KB
-
MD5
9b6af8aaca95df0fbced0a38e0f42fec
-
SHA1
27f2cb6e6c79f9ec7243c474d89a9017ce1458a0
-
SHA256
78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a
-
SHA512
d0da8ec346c5063214055e65ad64a3ee8d4d0b07645c1db069a421d47983a24f0e11ec94c990f0eadbd2a05ab38d548992655816965058f56eb9ba592005d415
-
SSDEEP
3072:0uFIXsAQyv5ENrlf0f6jMV2XtfhMsiBJ0FDCAvQ:lzAQ5lfC6jp6BJob
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/744-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exepid process 744 78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exe 744 78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exe 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exepid process 744 78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exe"C:\Users\Admin\AppData\Local\Temp\78077ff1e8c109107f9e8ad54c9a3660e3f8e966d61a5cd6b219e5d5226f104a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/744-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/744-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/744-55-0x0000000000CAB000-0x0000000000CBC000-memory.dmpFilesize
68KB
-
memory/744-57-0x0000000000400000-0x0000000000AD6000-memory.dmpFilesize
6.8MB
-
memory/744-58-0x0000000000400000-0x0000000000AD6000-memory.dmpFilesize
6.8MB