Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/12/2022, 06:24
Static task
static1
Behavioral task
behavioral1
Sample
19f9f3ac862be9429ffbe1a9020f957dc70471ceb51d7df5765d57f3a8b922bf.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
19f9f3ac862be9429ffbe1a9020f957dc70471ceb51d7df5765d57f3a8b922bf.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
19f9f3ac862be9429ffbe1a9020f957dc70471ceb51d7df5765d57f3a8b922bf.exe
-
Size
303KB
-
MD5
00876a9b7e7c38a919e992b1848ed811
-
SHA1
96f1d621e61280704bc9b99e16c3360696dcd854
-
SHA256
19f9f3ac862be9429ffbe1a9020f957dc70471ceb51d7df5765d57f3a8b922bf
-
SHA512
c88fcaa4dfefa0ebe4420858da78e1333b973c737fadfb943bbd7b0dd63a7760afd6e24b7bd40a968513e4b4158cef2a8820f9087d19bf3b1245c4d8c8a3dbe3
-
SSDEEP
6144:5QLuIUoGymkVWcna99N6pfpqyx0dz+3ng+E49HwchLP3i:iJUoRtVWeao9pqC0FwnVZH9P3
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/632-133-0x0000000002180000-0x0000000002189000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 19f9f3ac862be9429ffbe1a9020f957dc70471ceb51d7df5765d57f3a8b922bf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 19f9f3ac862be9429ffbe1a9020f957dc70471ceb51d7df5765d57f3a8b922bf.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 19f9f3ac862be9429ffbe1a9020f957dc70471ceb51d7df5765d57f3a8b922bf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 632 19f9f3ac862be9429ffbe1a9020f957dc70471ceb51d7df5765d57f3a8b922bf.exe 632 19f9f3ac862be9429ffbe1a9020f957dc70471ceb51d7df5765d57f3a8b922bf.exe 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1040 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 632 19f9f3ac862be9429ffbe1a9020f957dc70471ceb51d7df5765d57f3a8b922bf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19f9f3ac862be9429ffbe1a9020f957dc70471ceb51d7df5765d57f3a8b922bf.exe"C:\Users\Admin\AppData\Local\Temp\19f9f3ac862be9429ffbe1a9020f957dc70471ceb51d7df5765d57f3a8b922bf.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:632