Analysis
-
max time kernel
150s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-12-2022 17:24
Static task
static1
Behavioral task
behavioral1
Sample
82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe
Resource
win7-20220812-en
General
-
Target
82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe
-
Size
311KB
-
MD5
4d10dd0618309f40ecd7ec4a1363b4b3
-
SHA1
6e06c238c064950fed2be8d81e582aad21b3e6d8
-
SHA256
82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c
-
SHA512
dde5f5248f2200e18bcb751e74a970b0822449dcc578ef4b4988521a35edac4bca059c2fd5ea4e456381e1a73daae108626e1942f000dcf7d92056a23ebd1b2d
-
SSDEEP
6144:zs7LQk583d2N9COM0QkOmuF9H4rWlRjO1n:z48k583d2rm0QkOErW9u
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/900-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exepid process 900 82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe 900 82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 1192 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exepid process 900 82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe"C:\Users\Admin\AppData\Local\Temp\82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/900-54-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/900-55-0x000000000059C000-0x00000000005B1000-memory.dmpFilesize
84KB
-
memory/900-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/900-57-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/900-58-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB