Analysis

  • max time kernel
    150s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03-12-2022 11:11

General

  • Target

    f5e4f03420787e1defca6428d0c140095d5c2bc70843b5cb9cc39a93a2c3a9e6.exe

  • Size

    193KB

  • MD5

    54c681e380d762b65303213d8d6a71e3

  • SHA1

    e7e85ba192ae2b0083a08b2f3bb7846fdd9c0e62

  • SHA256

    f5e4f03420787e1defca6428d0c140095d5c2bc70843b5cb9cc39a93a2c3a9e6

  • SHA512

    ec2fa464776bda4294e90ee42371f5c07860dce9572aeb6445f75ebd98525548b3c63947c5a6f64cef1d0fa6dd0f3f615057ed460fe90431606168af4fd40171

  • SSDEEP

    3072:FbxrtHOjhtHbc5pissI1mEME3K8QIVZ91DAbEa/Yuoj:PBUhtHIik1mA3KHIb9yEa/Yp

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f5e4f03420787e1defca6428d0c140095d5c2bc70843b5cb9cc39a93a2c3a9e6.exe
    "C:\Users\Admin\AppData\Local\Temp\f5e4f03420787e1defca6428d0c140095d5c2bc70843b5cb9cc39a93a2c3a9e6.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2016

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1368-59-0x000007FEF6600000-0x000007FEF6743000-memory.dmp

    Filesize

    1.3MB

  • memory/1368-60-0x000007FE8AC90000-0x000007FE8AC9A000-memory.dmp

    Filesize

    40KB

  • memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

    Filesize

    8KB

  • memory/2016-56-0x0000000000220000-0x0000000000229000-memory.dmp

    Filesize

    36KB

  • memory/2016-55-0x00000000008CB000-0x00000000008DC000-memory.dmp

    Filesize

    68KB

  • memory/2016-57-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2016-58-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB