Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-01-2023 17:51
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
General
-
Target
file.exe
-
Size
176KB
-
MD5
59c488585bd2026e9801570209b7bd1d
-
SHA1
353ba91c0096fee87527b1b222a20777eeaf905d
-
SHA256
bc920b349c0edabf7b151dc527d3d4a31aabc2a24fb8265ead0b36f2695ef88f
-
SHA512
16690810fc2da536298bb5833bd89d16993fc99cac5d4115bbfe8fcf11e5517e66bf61cf2360360f6ede5ad7bd1921ca28e864fa7c66e9c2938c1ccc17a34b19
-
SSDEEP
3072:6BN2x8CJLaNLeR5S04YWCQPvuPnIsDzwBKFpWwCjJGV5Os:OCLgLe14YW7PGP1DkBKFAJiO
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1284-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 1284 file.exe 1284 file.exe 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1204 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 1284 file.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1284-54-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1284-55-0x0000000002D2D000-0x0000000002D40000-memory.dmpFilesize
76KB
-
memory/1284-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1284-57-0x0000000000400000-0x0000000002B96000-memory.dmpFilesize
39.6MB
-
memory/1284-58-0x0000000000400000-0x0000000002B96000-memory.dmpFilesize
39.6MB