Analysis
-
max time kernel
150s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-01-2023 02:56
Static task
static1
Behavioral task
behavioral1
Sample
ab1584a0064fc4a6132e8ae530bf2a27.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ab1584a0064fc4a6132e8ae530bf2a27.exe
Resource
win10v2004-20221111-en
General
-
Target
ab1584a0064fc4a6132e8ae530bf2a27.exe
-
Size
301KB
-
MD5
ab1584a0064fc4a6132e8ae530bf2a27
-
SHA1
bcee66986d10f96543ccd86f7263b5f57d675d5e
-
SHA256
9a303e830a991a9c14a70ecad4b52575b3ed0402d88aa2ff65acc5b776aeaeb7
-
SHA512
fe9ae0a5c725ef1e5b973782c10fd1e04ee16f0fe9da4a644444e5f47fb5df69b5d45cee2f94d5f423592d91b87c49f8558223f6978af579a2c95979250f8193
-
SSDEEP
3072:PHXeL8Yzm45itItsQFRWHAzphXaUseH4Z5KKmTk0sRi6zSbBLmY:veL86mhtGaUn45QsRi6WboY
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1076-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ab1584a0064fc4a6132e8ae530bf2a27.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ab1584a0064fc4a6132e8ae530bf2a27.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ab1584a0064fc4a6132e8ae530bf2a27.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ab1584a0064fc4a6132e8ae530bf2a27.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ab1584a0064fc4a6132e8ae530bf2a27.exepid process 1076 ab1584a0064fc4a6132e8ae530bf2a27.exe 1076 ab1584a0064fc4a6132e8ae530bf2a27.exe 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ab1584a0064fc4a6132e8ae530bf2a27.exepid process 1076 ab1584a0064fc4a6132e8ae530bf2a27.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1076-54-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1076-55-0x0000000002E0B000-0x0000000002E21000-memory.dmpFilesize
88KB
-
memory/1076-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1076-57-0x0000000000400000-0x0000000002C3F000-memory.dmpFilesize
40.2MB
-
memory/1076-58-0x0000000000400000-0x0000000002C3F000-memory.dmpFilesize
40.2MB