Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-12-2022 21:01
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
226KB
-
MD5
4492a6791a3e53bca0c5b050e3d395c1
-
SHA1
fda6d847dcef6a872c1ea5a03d4b712eade80597
-
SHA256
17be56c5627c7e925207de29508651d050467695f1b2bb2b023d25c9dac8818c
-
SHA512
c4f5931158f5e743f4ae39cef9be17542fbe6a4a3a354d88ff8e6a749911ebec96637ab9a6b7bbd6098dc38e0d7fa57386f2b2bb295d7d55ba58dab65e6911e8
-
SSDEEP
3072:mEmEL+kBD5Y5Tf+06ZleVjHNRSXUeXPH8oSTOQmsY3Ox6qQo3:XL+eqR+0g0jHNRe8ok7vHk5o
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2004-56-0x00000000001B0000-0x00000000001B9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 2004 file.exe 2004 file.exe 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1212 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 2004 file.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2004-54-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/2004-56-0x00000000001B0000-0x00000000001B9000-memory.dmpFilesize
36KB
-
memory/2004-55-0x000000000028A000-0x000000000029A000-memory.dmpFilesize
64KB
-
memory/2004-57-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/2004-58-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB