Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
03-01-2023 05:29
General
-
Target
7f52b14fbbffaf3925266b62217f988908f182afdd65cf6ef9c4854dbd4d5435.exe
-
Size
285KB
-
MD5
92e6862760bde6dbcb43bdc7dedf00e0
-
SHA1
72c393ff8b75ecf6ca467102571c9f1bf3744d51
-
SHA256
7f52b14fbbffaf3925266b62217f988908f182afdd65cf6ef9c4854dbd4d5435
-
SHA512
9bf97d30c544856de7bae1e84f64660b45453e90c58cb2a6fe99aaaaebdf7e8cf7bbd2fa62a879dac5ccf1558693d3918cf8ead101da0877fa31bdfbe96cd43f
-
SSDEEP
3072:ePqtQrQgqp5631NP8TVCfRia9u32TEGUWOF4nIwvz+2:uqgqml6TVQIf3kx1vS2
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f52b14fbbffaf3925266b62217f988908f182afdd65cf6ef9c4854dbd4d5435.exe"C:\Users\Admin\AppData\Local\Temp\7f52b14fbbffaf3925266b62217f988908f182afdd65cf6ef9c4854dbd4d5435.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\esgffetC:\Users\Admin\AppData\Roaming\esgffet1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
285KB
MD592e6862760bde6dbcb43bdc7dedf00e0
SHA172c393ff8b75ecf6ca467102571c9f1bf3744d51
SHA2567f52b14fbbffaf3925266b62217f988908f182afdd65cf6ef9c4854dbd4d5435
SHA5129bf97d30c544856de7bae1e84f64660b45453e90c58cb2a6fe99aaaaebdf7e8cf7bbd2fa62a879dac5ccf1558693d3918cf8ead101da0877fa31bdfbe96cd43f
-
Filesize
285KB
MD592e6862760bde6dbcb43bdc7dedf00e0
SHA172c393ff8b75ecf6ca467102571c9f1bf3744d51
SHA2567f52b14fbbffaf3925266b62217f988908f182afdd65cf6ef9c4854dbd4d5435
SHA5129bf97d30c544856de7bae1e84f64660b45453e90c58cb2a6fe99aaaaebdf7e8cf7bbd2fa62a879dac5ccf1558693d3918cf8ead101da0877fa31bdfbe96cd43f
-
Filesize
84KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
88KB
-
Filesize
36KB
-
Filesize
4.3MB
-
Filesize
4.3MB