Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-01-2023 21:14
Static task
static1
Behavioral task
behavioral1
Sample
sample49.exe
Resource
win7-20220812-en
5 signatures
150 seconds
General
-
Target
sample49.exe
-
Size
326KB
-
MD5
0e52ce86a2d20a563fabd3ec607bbc6f
-
SHA1
a6bc033ed4f146f2b8dc5b1ee2442d36d6688f62
-
SHA256
2c3198ff6c91c45d0ab3065676fdb89980d53ba8c51220fd42c3491eaea296ef
-
SHA512
70ac1ea1e1c739e70e25b233b46f18b8cfd4fa4bed643bf06f0503031b2704f9343aa305584446cfe7201b49d319967d3d33acf54348e29e32b1bbaf6c16729c
-
SSDEEP
6144:biR+Lhr4+AhY+r2BtyvFgBZ0tQK/fu1d0vmTb2:bJtr4+Ah8BiI2tQKXu1g
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1488-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sample49.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sample49.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sample49.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sample49.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sample49.exepid process 1488 sample49.exe 1488 sample49.exe 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
sample49.exepid process 1488 sample49.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1488-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/1488-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1488-55-0x000000000062B000-0x0000000000641000-memory.dmpFilesize
88KB
-
memory/1488-57-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1488-58-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB