Analysis
-
max time kernel
165s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-02-2023 08:09
Static task
static1
Behavioral task
behavioral1
Sample
df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exe
Resource
win10v2004-20221111-en
General
-
Target
df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exe
-
Size
295KB
-
MD5
0de13cd68f2e6a6959eade7c826366c0
-
SHA1
ec84f3033d3fc8c30dec2be4de06320b1f7b59d1
-
SHA256
df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8
-
SHA512
58b9de368a646508fec19067547e3591bf692447070d8d8ee57be040e098443aca9390d0e0cfc78777caf9ca996219734e0be36bd3fe4b3be9feb8cde8bc8780
-
SSDEEP
6144:ZQLRLGTAHplwcHNoMGtFNgmqMoIU2CX8M:Gdq8JHK/v/qMMX
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1812-56-0x00000000002A0000-0x00000000002A9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exepid process 1812 df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exe 1812 df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exe 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1288 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exepid process 1812 df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exe"C:\Users\Admin\AppData\Local\Temp\df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1812-54-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/1812-55-0x00000000004FD000-0x0000000000513000-memory.dmpFilesize
88KB
-
memory/1812-56-0x00000000002A0000-0x00000000002A9000-memory.dmpFilesize
36KB
-
memory/1812-57-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1812-58-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB