Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
11-01-2023 09:31
Static task
static1
Behavioral task
behavioral1
Sample
70d0f4ca40cba87f64e1d482c2eb7167.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
70d0f4ca40cba87f64e1d482c2eb7167.exe
Resource
win10v2004-20221111-en
General
-
Target
70d0f4ca40cba87f64e1d482c2eb7167.exe
-
Size
268KB
-
MD5
70d0f4ca40cba87f64e1d482c2eb7167
-
SHA1
2b375e2d01a2bcc809cb5f3adb94d7b2cbd05470
-
SHA256
4b1b659307debded98cb3939f879f71163ddfa774da3071ab0016e0db7bd6869
-
SHA512
81fafeb5c7b86e006cd1a8c5d26345bb54c817500cbddf3b94e206faf56b76bbb50a6d7311f8e532d2e97847558ae922f7cbf7621663bf789d7e8faaf1c951ef
-
SSDEEP
3072:BXEwys5StvLXoW9lM65yZ6AgC6rkkT0ZvQ0dOXOgtQilqzpsvUYLBpuEiYsBNCaR:l89vL9MzL6gOkv7OXvt39vxLWfNng6
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1708-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
70d0f4ca40cba87f64e1d482c2eb7167.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 70d0f4ca40cba87f64e1d482c2eb7167.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 70d0f4ca40cba87f64e1d482c2eb7167.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 70d0f4ca40cba87f64e1d482c2eb7167.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
70d0f4ca40cba87f64e1d482c2eb7167.exepid process 1708 70d0f4ca40cba87f64e1d482c2eb7167.exe 1708 70d0f4ca40cba87f64e1d482c2eb7167.exe 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1228 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
70d0f4ca40cba87f64e1d482c2eb7167.exepid process 1708 70d0f4ca40cba87f64e1d482c2eb7167.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1708-54-0x0000000075D51000-0x0000000075D53000-memory.dmpFilesize
8KB
-
memory/1708-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1708-55-0x0000000002C7D000-0x0000000002C8E000-memory.dmpFilesize
68KB
-
memory/1708-57-0x0000000000400000-0x0000000002BAB000-memory.dmpFilesize
39.7MB
-
memory/1708-58-0x0000000000400000-0x0000000002BAB000-memory.dmpFilesize
39.7MB