Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-01-2023 09:35
Static task
static1
Behavioral task
behavioral1
Sample
c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exe
Resource
win7-20220901-en
General
-
Target
c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exe
-
Size
326KB
-
MD5
98fc114b73984f38b0dacb75a2203e94
-
SHA1
fd93356ed9ac61f3751b16b262466b7425046286
-
SHA256
c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf
-
SHA512
3a4eebab680e7d397e1ef599f5f3185a8397c52896526570286fc9dd0648e1fd86c3df7e1d1dfeb8d04bed647ac71b52609d137f097f5a8953e0e186da098c21
-
SSDEEP
6144:+LBAumFVhQmRDgxorNuPEotQK/fu1d0FJDmTb:+eumFLQmRkawPPtQKXu1MJD
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1224-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exepid process 1224 c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exe 1224 c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exe 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 1284 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1284 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exepid process 1224 c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exe"C:\Users\Admin\AppData\Local\Temp\c41b3548c937cb667c40c688a018cbd3978efd5beb0bca348602141dd9f93caf.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1224-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmpFilesize
8KB
-
memory/1224-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1224-55-0x000000000050B000-0x0000000000521000-memory.dmpFilesize
88KB
-
memory/1224-57-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1224-58-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB