Analysis
- max time kernel
150s - max time network
45s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
12/01/2023, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
b4be08f67e4b5fed600bf5558b119168.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b4be08f67e4b5fed600bf5558b119168.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target b4be08f67e4b5fed600bf5558b119168.exe
- Size 321KB
- Sample230112-mxtcwsbe7v
- SHA256 7c46178edd00f3e93ad3cbfa7863ee643a0e79c1ac92eeeba42335e51855a423
- MD5 b4be08f67e4b5fed600bf5558b119168
- SHA1 1085a0382315e70dcf742419ed281516d5c9bfd5
- SHA512 4bf5854c89816bed737f0e86180f0e3d9fb4435df638e8c5bd9ef55f69d240e6272c7aa419acea859fce769faf6ec98fb3c8ac62324192b483c856698b9013e1
- SSDEEP 6144:OeAK9ry/8eXKyJRj8Itb+/1AP3Zi5tflxFzk:O49ry/8e6+FtYU3Zizfl8
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1508-56-0x00000000002B0000-0x00000000002B9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b4be08f67e4b5fed600bf5558b119168.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b4be08f67e4b5fed600bf5558b119168.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b4be08f67e4b5fed600bf5558b119168.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1508 b4be08f67e4b5fed600bf5558b119168.exe 1508 b4be08f67e4b5fed600bf5558b119168.exe 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1508 b4be08f67e4b5fed600bf5558b119168.exe