Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 00:05
Static task
static1
Behavioral task
behavioral1
Sample
35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exe
Resource
win10v2004-20220812-en
General
-
Target
35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exe
-
Size
147KB
-
MD5
1a91e69d7ac978fe7dbd9c1082e1abfd
-
SHA1
e688694596872d570350ac640464a47b9cd883e8
-
SHA256
35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553
-
SHA512
91a5573093c509d1c290f10528b1d2e9528785a58c372f5a9cdbe3856f0323430b1124af3502196dee45e5a7c5002da16aad6be775b9e89244f0838a9e434530
-
SSDEEP
3072:Tggb/rHnh5FmaEekNo1aGj5xPSTpcMfkPFE9Oxx/X:P7rHBEe1PvPmpZkP0O7X
Malware Config
Signatures
-
Detects Smokeloader packer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/768-55-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader behavioral1/memory/768-59-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exepid process 768 35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exe 768 35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exe 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exepid process 768 35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exe"C:\Users\Admin\AppData\Local\Temp\35728864feffc615636cd614008e7e3ed9fc697542c556f0edc98b705d4f2553.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-54-0x0000000000F5B000-0x0000000000F6C000-memory.dmpFilesize
68KB
-
memory/768-55-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/768-56-0x0000000076871000-0x0000000076873000-memory.dmpFilesize
8KB
-
memory/768-57-0x0000000000400000-0x0000000000AD6000-memory.dmpFilesize
6.8MB
-
memory/768-58-0x0000000000F5B000-0x0000000000F6C000-memory.dmpFilesize
68KB
-
memory/768-59-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/768-60-0x0000000000400000-0x0000000000AD6000-memory.dmpFilesize
6.8MB