Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
01-01-2023 13:02
General
-
Target
file.exe
-
Size
241KB
-
MD5
fd07055ab32bff6069441d57da3a715d
-
SHA1
a85603a05f6e15632d4abdad6cd44a19e431fb1c
-
SHA256
e999a37a6edf4e8308446416415d5815c88bdf8066d9aaeae1d77cc98e932b85
-
SHA512
dbad9270df76fd7c4c062eaa7ed5cb062e47afc8ace9ae57667e5aa96df6684a9b9e923f018f87f7c685fa3b09dc4798d8f9afae9da65f25b05e68ad418e879e
-
SSDEEP
3072:t8XZ3we9XqsLxWhCvecY5cG56RhcLjCishp4RTXWkhQRRUJMM2nvQGW7iSWt:WqeRqsL92sG0RxfL4prMV4b7i
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
36KB
-
Filesize
68KB
-
Filesize
356KB
-
Filesize
356KB