Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 10:30
Static task
static1
Behavioral task
behavioral1
Sample
be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exe
Resource
win10v2004-20221111-en
General
-
Target
be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exe
-
Size
341KB
-
MD5
ad0cdb9e4e1b21afe13af92c938aedf0
-
SHA1
d0f5bc954a29cba251331ce0f75942b027456a75
-
SHA256
be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c
-
SHA512
01106463bc9101b3aad033baf267a6d245c1358060bf94c2da5d7adbf782f0d8e21c96ebc1c41b4c15474fd7039f2550932df3fbb534b9212d1928a5ceba84a5
-
SSDEEP
6144:9PJL3GerFQeoRl/GPt7Ojq7VWRFBMolz90x+R1:bbGGFQeo7itF7VWR5lz7D
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4780-133-0x0000000002190000-0x0000000002199000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exepid process 4780 be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exe 4780 be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exe 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 2724 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2724 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exepid process 4780 be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exe"C:\Users\Admin\AppData\Local\Temp\be03b91b5a912496e981e24707d21df4e6cfade365bb5ba1f2d4ef2ea2fe668c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4780-132-0x00000000005CE000-0x00000000005E4000-memory.dmpFilesize
88KB
-
memory/4780-133-0x0000000002190000-0x0000000002199000-memory.dmpFilesize
36KB
-
memory/4780-134-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/4780-135-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB