Analysis
- max time kernel
190s - max time network
176s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
11/12/2022, 14:34
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target file.exe
- Size 325KB
- Sample221211-rxexqaha34
- SHA256 9b0652ee1f70fe88cbfb7cb27040b89725a073d3b5a7e4e93c4d6f5cc252b969
- MD5 d69743b446f4628d26d402d28ff15257
- SHA1 53a9a88f854d907aef1fcea3f76dd316b919f4c5
- SHA512 7ac6544b5ece31f2bf28e2655fbe7b0f0a2dd4b5ed0347e99ba6c048cbc125407d5408076df71ecd4f3a98477bd265791c9c3773300bd5af04e4d945b4febb6e
- SSDEEP 6144:/dRw2jLKho/dHmMJOD50bpLje1atpBYQW:/dVj2hoTljaatUQW
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 4 IoCs
resource yara_rule behavioral2/memory/540-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/4924-135-0x00000000005D0000-0x00000000005D9000-memory.dmp family_smokeloader behavioral2/memory/540-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/540-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4924 set thread context of 540 4924 file.exe 82 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 540 file.exe 540 file.exe 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2648 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 540 file.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4924 wrote to memory of 540 4924 file.exe 82 PID 4924 wrote to memory of 540 4924 file.exe 82 PID 4924 wrote to memory of 540 4924 file.exe 82 PID 4924 wrote to memory of 540 4924 file.exe 82 PID 4924 wrote to memory of 540 4924 file.exe 82 PID 4924 wrote to memory of 540 4924 file.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:540
-