Analysis
- max time kernel
149s - max time network
33s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system - submitted
13/12/2022, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
676067b532e78f6965701213cb76e53d0eee8d0767dbbf4598fd0dd1e211deba.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
676067b532e78f6965701213cb76e53d0eee8d0767dbbf4598fd0dd1e211deba.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target 676067b532e78f6965701213cb76e53d0eee8d0767dbbf4598fd0dd1e211deba.exe
- Size 234KB
- Sample221213-sebb9aeh73
- SHA256 676067b532e78f6965701213cb76e53d0eee8d0767dbbf4598fd0dd1e211deba
- MD5 5442e37b11909f7fe9d22be2a8153a06
- SHA1 aa902a962815eefe84f49249bba98868737da3bc
- SHA512 6f87bc4ef2c161ca2edce9d8967e3bb21ec8aa0b12ec1e74afe1f6b078ed01beac0b0d348c257ac4c1a110329fd83c0d7006155a079bcea27d7dffa3799b91fe
- SSDEEP 3072:FcyLjELANkmYhPY45rFO32MD5ZafPO6MPNTiKw2NiruKZWXgZbXJ2v40T2ui7le6:myULuYhPdccPO8KjNKYXigv9T2lhe6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1216-57-0x00000000001B0000-0x00000000001B9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 676067b532e78f6965701213cb76e53d0eee8d0767dbbf4598fd0dd1e211deba.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 676067b532e78f6965701213cb76e53d0eee8d0767dbbf4598fd0dd1e211deba.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 676067b532e78f6965701213cb76e53d0eee8d0767dbbf4598fd0dd1e211deba.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1216 676067b532e78f6965701213cb76e53d0eee8d0767dbbf4598fd0dd1e211deba.exe 1216 676067b532e78f6965701213cb76e53d0eee8d0767dbbf4598fd0dd1e211deba.exe 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1208 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1216 676067b532e78f6965701213cb76e53d0eee8d0767dbbf4598fd0dd1e211deba.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\676067b532e78f6965701213cb76e53d0eee8d0767dbbf4598fd0dd1e211deba.exe"C:\Users\Admin\AppData\Local\Temp\676067b532e78f6965701213cb76e53d0eee8d0767dbbf4598fd0dd1e211deba.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1216