Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-12-2022 01:02
Static task
static1
Behavioral task
behavioral1
Sample
e2f9ca7acd38048a5482f4b2049902ce1c4f5995.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e2f9ca7acd38048a5482f4b2049902ce1c4f5995.exe
Resource
win10v2004-20220812-en
General
-
Target
e2f9ca7acd38048a5482f4b2049902ce1c4f5995.exe
-
Size
215KB
-
MD5
25e1c36abd30bb9789820a87925ed873
-
SHA1
e2f9ca7acd38048a5482f4b2049902ce1c4f5995
-
SHA256
304ac147df967df0e2303d48de1ded9812063a20107cefdd8319b20de42deb70
-
SHA512
bf7427c25e150933eae626c708df9d92586f4ab1b8ba757a8892587d12bf01716357fb204314a4b0ce0657ae8cc566286fccfe6bc2a4a6c69e83e7231da6ca8d
-
SSDEEP
6144:zbcLcA86KMnLLq3Vr5NgzHAF8oH40M2b:zQR8am3LWjAq
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1980-57-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e2f9ca7acd38048a5482f4b2049902ce1c4f5995.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e2f9ca7acd38048a5482f4b2049902ce1c4f5995.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e2f9ca7acd38048a5482f4b2049902ce1c4f5995.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e2f9ca7acd38048a5482f4b2049902ce1c4f5995.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e2f9ca7acd38048a5482f4b2049902ce1c4f5995.exepid process 1980 e2f9ca7acd38048a5482f4b2049902ce1c4f5995.exe 1980 e2f9ca7acd38048a5482f4b2049902ce1c4f5995.exe 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e2f9ca7acd38048a5482f4b2049902ce1c4f5995.exepid process 1980 e2f9ca7acd38048a5482f4b2049902ce1c4f5995.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1980-54-0x0000000000618000-0x0000000000629000-memory.dmpFilesize
68KB
-
memory/1980-55-0x00000000756B1000-0x00000000756B3000-memory.dmpFilesize
8KB
-
memory/1980-57-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1980-56-0x0000000000618000-0x0000000000629000-memory.dmpFilesize
68KB
-
memory/1980-58-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1980-59-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB