Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
19-12-2022 16:37
Static task
static1
Behavioral task
behavioral1
Sample
a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exe
Resource
win7-20221111-en
General
-
Target
a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exe
-
Size
311KB
-
MD5
382f445fa18126435bbd631d6720bf88
-
SHA1
4d714a4c71e87dddaea89f8ada74f9feb2e83a6d
-
SHA256
a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc
-
SHA512
abf5c104c74aa27f3dab57971820d97a9c25f765e20e273433dafaa1b4a447cd4f781b1f47a6af8c0350c29cf05fe918b807b2d410ae3b500fe2d2876169f978
-
SSDEEP
6144:k9R3L2Hj5hkGIFcPlS9LP/M1FxPH4rWlRjO1n:kL8j5hkGIF0s9LXmxArW9u
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1876-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exepid process 1876 a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exe 1876 a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exe 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1248 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exepid process 1876 a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exe"C:\Users\Admin\AppData\Local\Temp\a1a43bced8befc305406d985748df07d8ee0cfeb1d76a271ec4f5499ea6423fc.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1876
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1248-59-0x000007FEF5BD0000-0x000007FEF5D13000-memory.dmpFilesize
1.3MB
-
memory/1248-60-0x000007FEB9690000-0x000007FEB969A000-memory.dmpFilesize
40KB
-
memory/1876-54-0x00000000757E1000-0x00000000757E3000-memory.dmpFilesize
8KB
-
memory/1876-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1876-55-0x00000000008DC000-0x00000000008F1000-memory.dmpFilesize
84KB
-
memory/1876-57-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1876-58-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB