Analysis
-
max time kernel
248s -
max time network
337s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 21:06
Static task
static1
Behavioral task
behavioral1
Sample
356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exe
Resource
win10v2004-20220901-en
General
-
Target
356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exe
-
Size
146KB
-
MD5
d3ca1d2e2a38db7c2924aa6ba8f6b7c3
-
SHA1
efdd5aae4010ad1c9444df486baf03d7a21f91a9
-
SHA256
356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de
-
SHA512
25a879d5cc4595eac49608c313b25b5b8772d46668ee7a724bec23ea8be6aef5077d956fe775a387c66183b478c09f58f2b24c4203361695a355b0f6a593274d
-
SSDEEP
3072:kr6/96rsuWn5xcfhm/9fyYLbB2KDhgw2Uk8bbHJp7m:n/Arsu1gfB2Uk87
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/664-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exepid process 664 356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exe 664 356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exe 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1284 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exepid process 664 356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exe"C:\Users\Admin\AppData\Local\Temp\356a724f59956fecf066f25a75a295b30bfb98207e0e71c4aaf917fa771251de.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/664-54-0x00000000763D1000-0x00000000763D3000-memory.dmpFilesize
8KB
-
memory/664-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/664-55-0x0000000000CBB000-0x0000000000CCC000-memory.dmpFilesize
68KB
-
memory/664-57-0x0000000000400000-0x0000000000AD6000-memory.dmpFilesize
6.8MB
-
memory/664-58-0x0000000000400000-0x0000000000AD6000-memory.dmpFilesize
6.8MB