Analysis
-
max time kernel
150s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
10/01/2023, 06:16
Static task
static1
Behavioral task
behavioral1
Sample
fd3573d4946a124e1015e953e50635fc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fd3573d4946a124e1015e953e50635fc.exe
Resource
win10v2004-20220812-en
General
-
Target
fd3573d4946a124e1015e953e50635fc.exe
-
Size
322KB
-
MD5
fd3573d4946a124e1015e953e50635fc
-
SHA1
bb65a9fc053df8ae09f7d38cdc162b69a1242e13
-
SHA256
056a9f3c70ffbfa9acd8551c4a229d28a9bf86df1e9be33011a50e92def38807
-
SHA512
006098c6e18d6b5f0c3302a813832bb13c430f49a5239b6dd3e9696ca1559c3ca1f285b65fea5d867fec7425f7ced16127798db07673612ee5696501b6f6b1c8
-
SSDEEP
3072:DXOmr55oqxbF7TN/N5umJ+eK7Lc86ywGTrLnpVTmQPlZzkuWdjJrhtHXcTz5VbmC:7Jd5Tbp/um3kwArLptRPwTHHXcjmf/y
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1204-56-0x00000000002A0000-0x00000000002A9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd3573d4946a124e1015e953e50635fc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd3573d4946a124e1015e953e50635fc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd3573d4946a124e1015e953e50635fc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1204 fd3573d4946a124e1015e953e50635fc.exe 1204 fd3573d4946a124e1015e953e50635fc.exe 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1244 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1204 fd3573d4946a124e1015e953e50635fc.exe