Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
14-01-2023 18:27
General
-
Target
f78d77b47be6ac716c67174226944e8a1e86cd59f75456bd1330160710f98844.exe
-
Size
260KB
-
MD5
5d6911c0ecd29af35a5c21d36558f258
-
SHA1
0c31781bcbfb0acf60925aa0d71f6a81c077d9bb
-
SHA256
f78d77b47be6ac716c67174226944e8a1e86cd59f75456bd1330160710f98844
-
SHA512
74abdd7de80e393379e7d3bd9811debc34d0185ec429f0b629abbd8852970612691fce54dc11c9f0cb766654f7578697e4324fb7324803e2f269d1f1281fcf88
-
SSDEEP
3072:3XmpSrmr5RMoKwV6+sIF8h7jxsYCw2uBx0wvo/apb8pBI8jwWRjoV:n+3k+sIFMsc2wVpgpRjFE
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f78d77b47be6ac716c67174226944e8a1e86cd59f75456bd1330160710f98844.exe"C:\Users\Admin\AppData\Local\Temp\f78d77b47be6ac716c67174226944e8a1e86cd59f75456bd1330160710f98844.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\cjrugjgC:\Users\Admin\AppData\Roaming\cjrugjg1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260KB
MD55d6911c0ecd29af35a5c21d36558f258
SHA10c31781bcbfb0acf60925aa0d71f6a81c077d9bb
SHA256f78d77b47be6ac716c67174226944e8a1e86cd59f75456bd1330160710f98844
SHA51274abdd7de80e393379e7d3bd9811debc34d0185ec429f0b629abbd8852970612691fce54dc11c9f0cb766654f7578697e4324fb7324803e2f269d1f1281fcf88
-
Filesize
260KB
MD55d6911c0ecd29af35a5c21d36558f258
SHA10c31781bcbfb0acf60925aa0d71f6a81c077d9bb
SHA256f78d77b47be6ac716c67174226944e8a1e86cd59f75456bd1330160710f98844
SHA51274abdd7de80e393379e7d3bd9811debc34d0185ec429f0b629abbd8852970612691fce54dc11c9f0cb766654f7578697e4324fb7324803e2f269d1f1281fcf88
-
Filesize
68KB
-
Filesize
36KB
-
Filesize
39.7MB
-
Filesize
39.7MB
-
Filesize
68KB
-
Filesize
39.7MB
-
Filesize
39.7MB