Analysis
- max time kernel
150s - max time network
30s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system - submitted
02/01/2023, 12:16
Static task
static1
Behavioral task
behavioral1
Sample
8a307d860136a10c6c89b549a2e0d4a8.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
8a307d860136a10c6c89b549a2e0d4a8.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 8a307d860136a10c6c89b549a2e0d4a8.exe
- Size 216KB
- Sample230102-pffrkshb9y
- SHA256 46763a6c69ef95bcb1e5f62b7d2cfbfe60c26df1b65a0731a3b3050d85229660
- MD5 8a307d860136a10c6c89b549a2e0d4a8
- SHA1 1da0e2909b4b5f3729972cc594f4cf404cc94a1c
- SHA512 c543dcaee0f8b4f29bb1596fa6152caccb92a0e40cdd4425383974729a06bf9dedd7e5b047b7e03bb28c1ec656b89782342949a0a5e8e153e46bcfb510f73234
- SSDEEP 3072:1XZd7fJJLtyoUklVI25j2aRpwlZN3r+SCa5+QVilIdF0PW6:xPfnLFmW1R2lZmRAic0b
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1876-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8a307d860136a10c6c89b549a2e0d4a8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8a307d860136a10c6c89b549a2e0d4a8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8a307d860136a10c6c89b549a2e0d4a8.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1876 8a307d860136a10c6c89b549a2e0d4a8.exe 1876 8a307d860136a10c6c89b549a2e0d4a8.exe 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1248 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1876 8a307d860136a10c6c89b549a2e0d4a8.exe