Analysis
-
max time kernel
151s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-01-2023 08:26
Static task
static1
Behavioral task
behavioral1
Sample
37e7a0cb57d41de9d7c3224ea706d956.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
37e7a0cb57d41de9d7c3224ea706d956.exe
Resource
win10v2004-20221111-en
General
-
Target
37e7a0cb57d41de9d7c3224ea706d956.exe
-
Size
329KB
-
MD5
37e7a0cb57d41de9d7c3224ea706d956
-
SHA1
6464fb777364a70bf9fb53963edfe114d884842a
-
SHA256
7e3cdf01398c97f906a619d9a8234cb25029084cbc8ff54a927e903df7cf2f9d
-
SHA512
dd373babbd100c38b6bfadc2a24f1cfdf9b48e8234c0fb34118ae2b0825b5c3d88e74f7c9796f14ba9e11d6ceeb564db575be97c2aa9e57742c4021af6f5c7e9
-
SSDEEP
6144:EDL1ZK+S+qctFrMlta7mwGsztQK/fu1d0xrhRE9mTbV:EDxZlt+zwmetQKXu1yNM
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1160-56-0x00000000001C0000-0x00000000001C9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
37e7a0cb57d41de9d7c3224ea706d956.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 37e7a0cb57d41de9d7c3224ea706d956.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 37e7a0cb57d41de9d7c3224ea706d956.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 37e7a0cb57d41de9d7c3224ea706d956.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
37e7a0cb57d41de9d7c3224ea706d956.exepid process 1160 37e7a0cb57d41de9d7c3224ea706d956.exe 1160 37e7a0cb57d41de9d7c3224ea706d956.exe 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
37e7a0cb57d41de9d7c3224ea706d956.exepid process 1160 37e7a0cb57d41de9d7c3224ea706d956.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1160-54-0x0000000075A91000-0x0000000075A93000-memory.dmpFilesize
8KB
-
memory/1160-55-0x000000000028C000-0x00000000002A1000-memory.dmpFilesize
84KB
-
memory/1160-56-0x00000000001C0000-0x00000000001C9000-memory.dmpFilesize
36KB
-
memory/1160-57-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1160-58-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB