Analysis
-
max time kernel
150s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-12-2022 20:48
Static task
static1
Behavioral task
behavioral1
Sample
0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exe
Resource
win10v2004-20221111-en
General
-
Target
0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exe
-
Size
316KB
-
MD5
1cd8b593c078ed11ca602da358452c48
-
SHA1
801efb1fdb58c0d8e64bff1f191246532f173176
-
SHA256
0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1
-
SHA512
139da83b3acdf408faf14781e73ca2fd762b57049d994402ac74dee19bfbdfeced04f11a5e2061be1dd838b971b5ceef8fd084c8afb60a897f73d0940d38b1c8
-
SSDEEP
6144:AwKLwDWwbFZ63959D1rDQuoFUgRR0cSpQTtyzsduHNIv:/K8DWwT6NbBDQHnRR0TCtyYduHNI
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1456-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exepid process 1456 0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exe 1456 0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exe 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 1396 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exepid process 1456 0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exe"C:\Users\Admin\AppData\Local\Temp\0fe0fdd956b57cbd0cfc4998c65e9a762781b01d3f3cd69b0096897c8fc275d1.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1456-54-0x00000000768A1000-0x00000000768A3000-memory.dmpFilesize
8KB
-
memory/1456-55-0x000000000058C000-0x00000000005A1000-memory.dmpFilesize
84KB
-
memory/1456-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1456-57-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1456-58-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB