Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
24/01/2023, 21:29
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target file.exe
- Size 175KB
- Sample230124-1bwssafe5x
- SHA256 d4cf72c22534fd1dceb4c0f88842563eb5b8a9f958f30066b4271411c19dc6af
- MD5 be5b0a8e2eebca92ae7b6312c7ff381e
- SHA1 7ab533258c202180deb1fac5bb6c32f065132bd8
- SHA512 074c4564f588af68c0c52308a504103213cae5f79fa1ee6af02d47e125fc83e7f3abc421fdfe23d7393f641d381bcbb6b09946caab0120e03479dd2ef9770b98
- SSDEEP 3072:hBN2/tnQLWUFNi+51GTMd+LYmlMfh85wAYOVJqO+Qt7+Swv9gh:HlLpNig+o5mafh8CkJJ+Qta8
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/404-133-0x0000000002C50000-0x0000000002C59000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 5092 sfhvcjr - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sfhvcjr Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sfhvcjr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sfhvcjr - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 404 file.exe 404 file.exe 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found 1952 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1952 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 404 file.exe 5092 sfhvcjr
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:404
-
C:\Users\Admin\AppData\Roaming\sfhvcjrC:\Users\Admin\AppData\Roaming\sfhvcjr1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5092
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\sfhvcjr
- Size 175KB
- SHA256 d4cf72c22534fd1dceb4c0f88842563eb5b8a9f958f30066b4271411c19dc6af
- MD5 be5b0a8e2eebca92ae7b6312c7ff381e
- SHA1 7ab533258c202180deb1fac5bb6c32f065132bd8
- SHA512 074c4564f588af68c0c52308a504103213cae5f79fa1ee6af02d47e125fc83e7f3abc421fdfe23d7393f641d381bcbb6b09946caab0120e03479dd2ef9770b98
- SSDEEP 3072:hBN2/tnQLWUFNi+51GTMd+LYmlMfh85wAYOVJqO+Qt7+Swv9gh:HlLpNig+o5mafh8CkJJ+Qta8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\sfhvcjr
- Size 175KB
- SHA256 d4cf72c22534fd1dceb4c0f88842563eb5b8a9f958f30066b4271411c19dc6af
- MD5 be5b0a8e2eebca92ae7b6312c7ff381e
- SHA1 7ab533258c202180deb1fac5bb6c32f065132bd8
- SHA512 074c4564f588af68c0c52308a504103213cae5f79fa1ee6af02d47e125fc83e7f3abc421fdfe23d7393f641d381bcbb6b09946caab0120e03479dd2ef9770b98
- SSDEEP 3072:hBN2/tnQLWUFNi+51GTMd+LYmlMfh85wAYOVJqO+Qt7+Swv9gh:HlLpNig+o5mafh8CkJJ+Qta8
- MD5 SHA1 SHA512 SSDEEP