Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
08/02/2023, 08:02
General
-
Target
97cbef810fb6de96dd3bbe00939450adfae329e8818b50a52323ae942aaf612c.exe
-
Size
313KB
-
MD5
18582cddd52df257afbda34b15d23ba1
-
SHA1
558e142310368ad7a00957f45c86f8569ac60c7d
-
SHA256
97cbef810fb6de96dd3bbe00939450adfae329e8818b50a52323ae942aaf612c
-
SHA512
3cbd7479248875977f9d876f19f967ebbbe63bd5350be114670bc14b5467dce595ca9aa1ebbba9a5b7909365508638bdda4b5cdcf3d074ba05806a6717a81760
-
SSDEEP
3072:4wtq+1XewXR5WQJw/PeJYbwWnmBBo+dtPQGG+WByUAl1t8UFBWR:4kJ1uUWQu+ubwWnIqQPQGVWUjtTFIR
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97cbef810fb6de96dd3bbe00939450adfae329e8818b50a52323ae942aaf612c.exe"C:\Users\Admin\AppData\Local\Temp\97cbef810fb6de96dd3bbe00939450adfae329e8818b50a52323ae942aaf612c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\97cbef810fb6de96dd3bbe00939450adfae329e8818b50a52323ae942aaf612c.exe"C:\Users\Admin\AppData\Local\Temp\97cbef810fb6de96dd3bbe00939450adfae329e8818b50a52323ae942aaf612c.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB