Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17-12-2022 17:47
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
214KB
-
MD5
6051cf3938f73f40d4a4b7f3926d6764
-
SHA1
3f7062bc658f15c2c9710394e50386fae2ad09c5
-
SHA256
bed20f2b8b7763670652ab07352843768ab74d71b273d00fa7dc75df8858b990
-
SHA512
708b27bb9b2b4d21beb9a3444a6c080b83726f4cb37d9784bb22e6676f796a56fcf49ac595f89704b72487273b475c58a3c98a51016e52666d5d84a1a5266b56
-
SSDEEP
3072:rlLT5zPLKvTR5rEXbLwVLmpUW5Yv8/g3xotuNjG3ERWR3Le:BHRPLKnAXbLKLmp59g3CCCU0V6
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/108-57-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 108 file.exe 108 file.exe 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 108 file.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/108-54-0x00000000008D8000-0x00000000008E9000-memory.dmpFilesize
68KB
-
memory/108-55-0x0000000075B41000-0x0000000075B43000-memory.dmpFilesize
8KB
-
memory/108-57-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/108-56-0x00000000008D8000-0x00000000008E9000-memory.dmpFilesize
68KB
-
memory/108-58-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/108-59-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB