Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21-12-2022 07:46
Static task
static1
Behavioral task
behavioral1
Sample
c381be74503802df85c2eeeee364af5b.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
-
Target
c381be74503802df85c2eeeee364af5b.exe
-
Size
215KB
-
MD5
c381be74503802df85c2eeeee364af5b
-
SHA1
c9758f326774a055ef4ea3d8a5ce2efff1f724c1
-
SHA256
af15f13244a94810f88fb859feffdcdd6793c1eb7298e71060f7181fc6f76e8b
-
SHA512
54d879d369edde5f8a11f533d9186cdd92f7c4510a47f210973af49a3502896ca0c20b6074bfc14bfa4eb01aa41ee1957f46aa58562d082c318cc7438118f274
-
SSDEEP
3072:A48kYLJGV5NnPEOpAc6cYc7istOV8A7b/PHrNyAC8skNHCDml:n8xLJkPEOpAhlc71tI8QHHrNCa
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/752-57-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c381be74503802df85c2eeeee364af5b.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c381be74503802df85c2eeeee364af5b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c381be74503802df85c2eeeee364af5b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c381be74503802df85c2eeeee364af5b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c381be74503802df85c2eeeee364af5b.exepid process 752 c381be74503802df85c2eeeee364af5b.exe 752 c381be74503802df85c2eeeee364af5b.exe 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c381be74503802df85c2eeeee364af5b.exepid process 752 c381be74503802df85c2eeeee364af5b.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/752-54-0x00000000008B8000-0x00000000008C9000-memory.dmpFilesize
68KB
-
memory/752-55-0x0000000075241000-0x0000000075243000-memory.dmpFilesize
8KB
-
memory/752-57-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/752-56-0x00000000008B8000-0x00000000008C9000-memory.dmpFilesize
68KB
-
memory/752-58-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/752-59-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB