Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
05/12/2022, 00:38
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target file.exe
- Size 371KB
- Sample221205-ay2z7sed2w
- SHA256 18180a401682ac1e11f87fbc95a9de4c066d7899c930a963c5fd7ddb557ea535
- MD5 cd06a4b41c1edeb8fde3f2a80eac16d1
- SHA1 76cf1faed226ba771dc13e37406bbcbe9faa69ef
- SHA512 b06463e9ef80f158b0a43b1e76be4f2e4c083bf1de2f1ac4c683668d3a4d6f539323421b57af8c98a56f0b93496e9c4abc6b5709f47a48a344a9a1b61eecfa06
- SSDEEP 6144:tOtw3ATi9Iwkbdg1Qc6TYYHF5cyHymlglQdaG1PI:tOtQAe9IzZgCXsYH5HyWglJG
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 2 IoCs
resource yara_rule behavioral2/memory/2280-134-0x0000000000030000-0x0000000000039000-memory.dmp family_smokeloader behavioral2/memory/2280-136-0x0000000000030000-0x0000000000039000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 2596 eahuhah - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eahuhah Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eahuhah Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eahuhah - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2280 file.exe 2280 file.exe 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2648 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2280 file.exe 2596 eahuhah
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2280
-
C:\Users\Admin\AppData\Roaming\eahuhahC:\Users\Admin\AppData\Roaming\eahuhah1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2596
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\eahuhah
- Size 371KB
- SHA256 18180a401682ac1e11f87fbc95a9de4c066d7899c930a963c5fd7ddb557ea535
- MD5 cd06a4b41c1edeb8fde3f2a80eac16d1
- SHA1 76cf1faed226ba771dc13e37406bbcbe9faa69ef
- SHA512 b06463e9ef80f158b0a43b1e76be4f2e4c083bf1de2f1ac4c683668d3a4d6f539323421b57af8c98a56f0b93496e9c4abc6b5709f47a48a344a9a1b61eecfa06
- SSDEEP 6144:tOtw3ATi9Iwkbdg1Qc6TYYHF5cyHymlglQdaG1PI:tOtQAe9IzZgCXsYH5HyWglJG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\eahuhah
- Size 371KB
- SHA256 18180a401682ac1e11f87fbc95a9de4c066d7899c930a963c5fd7ddb557ea535
- MD5 cd06a4b41c1edeb8fde3f2a80eac16d1
- SHA1 76cf1faed226ba771dc13e37406bbcbe9faa69ef
- SHA512 b06463e9ef80f158b0a43b1e76be4f2e4c083bf1de2f1ac4c683668d3a4d6f539323421b57af8c98a56f0b93496e9c4abc6b5709f47a48a344a9a1b61eecfa06
- SSDEEP 6144:tOtw3ATi9Iwkbdg1Qc6TYYHF5cyHymlglQdaG1PI:tOtQAe9IzZgCXsYH5HyWglJG
- MD5 SHA1 SHA512 SSDEEP