Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
19-12-2022 14:10
General
-
Target
file.exe
-
Size
310KB
-
MD5
f14580f740879c9230c6279de9884f5f
-
SHA1
34bbebb5cde36964e902c0aba70c971f207efa05
-
SHA256
f99d35d14e88e96a1aeb242b4d7aae7f187a43e6b986e3ce55826e0c3c840d72
-
SHA512
f73ce4acabdc3f761d54c6b77dd088b435ee0de35a6b6de2aab625c2aada603c358ee78a8c82144b5b975aec45cf4f68d93a9430568f12dc2a919a3a88a35dfc
-
SSDEEP
6144:H5zL35k5l27GmrryI0p5lGa0H4rWlRjO1n:HBj5k5QqmKnrlGaXrW9u
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1500-54-0x0000000075B41000-0x0000000075B43000-memory.dmpFilesize
8KB
-
memory/1500-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1500-55-0x000000000061C000-0x0000000000631000-memory.dmpFilesize
84KB
-
memory/1500-57-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1500-58-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB