Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
14-12-2022 15:07
Static task
static1
Behavioral task
behavioral1
Sample
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe
Resource
win10v2004-20221111-en
General
-
Target
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe
-
Size
233KB
-
MD5
6cf78b93ea34e9eb07a574d238e9ed11
-
SHA1
6d8c7a63e98463c3beaa69ee5c5376fd7009a287
-
SHA256
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8
-
SHA512
1da9dd07da41442ee67396598ad502483088797cebe57bd6b7ab137c5097056df580d6e2a60b3a78b3cea5b0f021bf1eb643c10a083c5408db33b735ba018d51
-
SSDEEP
3072:vmBZdp/nU8MLODf4s8fB9z5U9HL8vLJOjqmN3fZlNBKYIsXhVQdl6py:vmVp/nyLC4s8fe5L8DwuyNY2+l6o
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1324-57-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exepid process 1324 9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe 1324 9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1400 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exepid process 1324 9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe"C:\Users\Admin\AppData\Local\Temp\9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1324-54-0x00000000005A8000-0x00000000005B9000-memory.dmpFilesize
68KB
-
memory/1324-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmpFilesize
8KB
-
memory/1324-56-0x00000000005A8000-0x00000000005B9000-memory.dmpFilesize
68KB
-
memory/1324-57-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1324-58-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1324-59-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1400-60-0x000007FEF6A90000-0x000007FEF6BD3000-memory.dmpFilesize
1.3MB
-
memory/1400-61-0x000007FE9E6C0000-0x000007FE9E6CA000-memory.dmpFilesize
40KB