Analysis
- max time kernel
150s - max time network
45s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
08/01/2023, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
9eb387a1e626920487a89adccfa6ecba.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
9eb387a1e626920487a89adccfa6ecba.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
36 signatures
150 seconds
General
- Target 9eb387a1e626920487a89adccfa6ecba.exe
- Size 264KB
- Sample230108-wwfvvahg4w
- SHA256 f03f6bafa9ceb05b4372b0cd49be8ca5a67abb5735414cde964289f0ccc516af
- MD5 9eb387a1e626920487a89adccfa6ecba
- SHA1 a1c09e855abba39759d69c793671ab92e9ff471c
- SHA512 65466460ab2cd0e3510f67c079d9b5c6c5d9a96d36478e07edaec5ea62a7b2eccdd85801d2476047df10ddf16a674d0b1eb49c99dca290dd3d5c9c825d9e85b2
- SSDEEP 3072:5XhJ8LCLnsf0xHfBrB5gOeOWHJ3bEr9UGN3monBS9epxOQzWUZNTKXWPr0sdl:dVLnNNfBrxZWHJ3beUS3m8LJzOuNl
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/980-56-0x00000000002A0000-0x00000000002A9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9eb387a1e626920487a89adccfa6ecba.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9eb387a1e626920487a89adccfa6ecba.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9eb387a1e626920487a89adccfa6ecba.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 980 9eb387a1e626920487a89adccfa6ecba.exe 980 9eb387a1e626920487a89adccfa6ecba.exe 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 980 9eb387a1e626920487a89adccfa6ecba.exe