Analysis
-
max time kernel
253s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
11/02/2023, 12:56
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
file.exe
-
Size
379KB
-
MD5
91372052396700a19a7c676009a8a4f7
-
SHA1
e4c883790035bc99ab7bbfc8402be6463fbb2a38
-
SHA256
a287ba0ec1a391b0dcf9072228f1ffcc0b9a1e621dd5f0f6dc0180c7109717e8
-
SHA512
510998416590f31106f10455771a1f0cd246b1ae1569c213219c7e0e23f876759e30582dcf546cedc129b57d81535b1bba77fd1edb5604ea1ccf55c16909a723
-
SSDEEP
6144:VB7WoRlUENcis6Jw+BZgt+O//U9ql9dKlTRT66Mh4F:L7Wgy+w+PgYfI9wJRc4F
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 5 IoCs
resource yara_rule behavioral1/memory/2036-54-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2036-55-0x0000000000402DD8-mapping.dmp family_smokeloader behavioral1/memory/520-58-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader behavioral1/memory/2036-59-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2036-60-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 520 set thread context of 2036 520 file.exe 28 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2036 file.exe 2036 file.exe 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found 1228 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1228 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2036 file.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 520 wrote to memory of 2036 520 file.exe 28 PID 520 wrote to memory of 2036 520 file.exe 28 PID 520 wrote to memory of 2036 520 file.exe 28 PID 520 wrote to memory of 2036 520 file.exe 28 PID 520 wrote to memory of 2036 520 file.exe 28 PID 520 wrote to memory of 2036 520 file.exe 28 PID 520 wrote to memory of 2036 520 file.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2036
-