Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2023, 13:05
Static task
static1
Behavioral task
behavioral1
Sample
8a29e1c6c28c4124ac50b1dd1424ad8e7316eff59cb4b9a6dcafb9556aee4d64.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
8a29e1c6c28c4124ac50b1dd1424ad8e7316eff59cb4b9a6dcafb9556aee4d64.exe
-
Size
216KB
-
MD5
fb7d814cdf9ff8996c0137037063a492
-
SHA1
26cb20e585f39ce0f48426dbabe4fb2f9056c6db
-
SHA256
8a29e1c6c28c4124ac50b1dd1424ad8e7316eff59cb4b9a6dcafb9556aee4d64
-
SHA512
2ae85f076053d65aa56e2150b3b3bbb386c0f3d8956ec5ba0bfba6550640a0c416fad3ccad3e0ad150fd0b708617e28d872cb644a0502edd731199a3b28a57e2
-
SSDEEP
3072:vXcb/MeLQu3Mh07St57T5A5/Fr+8wTHBRTXId/1fW6:fIZL37SbTGXS8kLQr
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/4336-133-0x00000000005E0000-0x00000000005E9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8a29e1c6c28c4124ac50b1dd1424ad8e7316eff59cb4b9a6dcafb9556aee4d64.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8a29e1c6c28c4124ac50b1dd1424ad8e7316eff59cb4b9a6dcafb9556aee4d64.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8a29e1c6c28c4124ac50b1dd1424ad8e7316eff59cb4b9a6dcafb9556aee4d64.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4336 8a29e1c6c28c4124ac50b1dd1424ad8e7316eff59cb4b9a6dcafb9556aee4d64.exe 4336 8a29e1c6c28c4124ac50b1dd1424ad8e7316eff59cb4b9a6dcafb9556aee4d64.exe 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 784 Process not Found -
Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 4336 8a29e1c6c28c4124ac50b1dd1424ad8e7316eff59cb4b9a6dcafb9556aee4d64.exe 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found 784 Process not Found -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 784 wrote to memory of 3528 784 Process not Found 86 PID 784 wrote to memory of 3528 784 Process not Found 86 PID 784 wrote to memory of 3528 784 Process not Found 86 PID 784 wrote to memory of 3528 784 Process not Found 86 PID 784 wrote to memory of 3648 784 Process not Found 87 PID 784 wrote to memory of 3648 784 Process not Found 87 PID 784 wrote to memory of 3648 784 Process not Found 87 PID 784 wrote to memory of 4944 784 Process not Found 88 PID 784 wrote to memory of 4944 784 Process not Found 88 PID 784 wrote to memory of 4944 784 Process not Found 88 PID 784 wrote to memory of 4944 784 Process not Found 88 PID 784 wrote to memory of 1020 784 Process not Found 89 PID 784 wrote to memory of 1020 784 Process not Found 89 PID 784 wrote to memory of 1020 784 Process not Found 89 PID 784 wrote to memory of 4372 784 Process not Found 90 PID 784 wrote to memory of 4372 784 Process not Found 90 PID 784 wrote to memory of 4372 784 Process not Found 90 PID 784 wrote to memory of 4372 784 Process not Found 90 PID 784 wrote to memory of 3824 784 Process not Found 91 PID 784 wrote to memory of 3824 784 Process not Found 91 PID 784 wrote to memory of 3824 784 Process not Found 91 PID 784 wrote to memory of 3824 784 Process not Found 91 PID 784 wrote to memory of 4140 784 Process not Found 92 PID 784 wrote to memory of 4140 784 Process not Found 92 PID 784 wrote to memory of 4140 784 Process not Found 92 PID 784 wrote to memory of 4140 784 Process not Found 92 PID 784 wrote to memory of 3308 784 Process not Found 93 PID 784 wrote to memory of 3308 784 Process not Found 93 PID 784 wrote to memory of 3308 784 Process not Found 93 PID 784 wrote to memory of 3288 784 Process not Found 94 PID 784 wrote to memory of 3288 784 Process not Found 94 PID 784 wrote to memory of 3288 784 Process not Found 94 PID 784 wrote to memory of 3288 784 Process not Found 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a29e1c6c28c4124ac50b1dd1424ad8e7316eff59cb4b9a6dcafb9556aee4d64.exe"C:\Users\Admin\AppData\Local\Temp\8a29e1c6c28c4124ac50b1dd1424ad8e7316eff59cb4b9a6dcafb9556aee4d64.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4336
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3528
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3648
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4944
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1020
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4372
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3824
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4140
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3308
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3288