Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/02/2023, 06:54
Static task
static1
Behavioral task
behavioral1
Sample
346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe
-
Size
283KB
-
MD5
0d692ae547062a730f37fe22d79423ce
-
SHA1
6f948830bba9f675e11292c667c69c50651db245
-
SHA256
346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6
-
SHA512
ff8aeb9b39be3a71316795b1b6e82fac34ba0ed90f1a1bb85e8a88fa3e9ae9de973a21c2267d2518c0d07689b14c9bbce6dfccc58b0a59e0f8200821b7fb32db
-
SSDEEP
3072:laXXOnPLPX0AyLpE+fLwLWDu95d1flN2dsR2fFiIMKMQ0X8cSWfBaJDN:4XXc7XaLpE+TUPv2uRLIFhe3BaJR
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 5 IoCs
resource yara_rule behavioral1/memory/1880-55-0x0000000000402DD8-mapping.dmp family_smokeloader behavioral1/memory/1884-58-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader behavioral1/memory/1880-54-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1880-59-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1880-60-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1884 set thread context of 1880 1884 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe 27 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1880 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe 1880 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found 1268 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1880 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1884 wrote to memory of 1880 1884 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe 27 PID 1884 wrote to memory of 1880 1884 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe 27 PID 1884 wrote to memory of 1880 1884 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe 27 PID 1884 wrote to memory of 1880 1884 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe 27 PID 1884 wrote to memory of 1880 1884 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe 27 PID 1884 wrote to memory of 1880 1884 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe 27 PID 1884 wrote to memory of 1880 1884 346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe"C:\Users\Admin\AppData\Local\Temp\346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe"C:\Users\Admin\AppData\Local\Temp\346e189f1e8ae150e3376a4361eedcaffafe60f1de4939d879b09a379a196ad6.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1880
-