Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-12-2022 18:32
Static task
static1
Behavioral task
behavioral1
Sample
2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exe
Resource
win10v2004-20220812-en
General
-
Target
2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exe
-
Size
228KB
-
MD5
e73e74eb094cd75c4fef906d193bf7bc
-
SHA1
7d734ce05ef41e92028ca8754db46fb146dc12d7
-
SHA256
2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c
-
SHA512
5bc69c2c41e591630320e54a2c7671b477c330087ad5d45c9e7f4b1981084b1927dd2c9cf6e8ea53b7dfc80f89a4bf2e1a98f566b5ad35116c2237ebbed433b5
-
SSDEEP
3072:eeTJLbPtnRkYHyLNU1Ou+oukzEWBkOuRGK:7dLbHMUdukYpjcK
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1380-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exepid process 1380 2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exe 1380 2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exe 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 1252 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1252 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exepid process 1380 2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exe"C:\Users\Admin\AppData\Local\Temp\2ac911e9b7c9c2a5bc94a3378e4a07425ebfcf67889422579e32b11e942fee6c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1252-59-0x000007FEF6230000-0x000007FEF6373000-memory.dmpFilesize
1.3MB
-
memory/1252-60-0x000007FEA0BB0000-0x000007FEA0BBA000-memory.dmpFilesize
40KB
-
memory/1380-54-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/1380-55-0x00000000005CA000-0x00000000005DA000-memory.dmpFilesize
64KB
-
memory/1380-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1380-57-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/1380-58-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB