Overview

overview

10

Static

static

1

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    16-02-2023 19:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    253KB

  • MD5

    c5f8330200b3c3838d3496b88598edbd

  • SHA1

    b8cb4b82708413afddff88621bedfebc377ede7f

  • SHA256

    c9fde93529396b5fa4d49f8932ff113dcb813a30462c32312ff1ef259ab1989d

  • SHA512

    e688b002089b93980dd601e6e1da472f4cc6e6610db6f1ed0b6898db41c042384773c8d3555ac069a99b4f84e1ecc5a03ae125508fdfba7dac122f99a351fd31

  • SSDEEP

    3072:yhRULo25U2WOm5ucfGKfrrYptgAL8umV6ojfmfHPVUE7cY:2iLoiWMuGG4tNmV6k8HOs

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1508

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1248-59-0x000007FEF5BD0000-0x000007FEF5D13000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1248-60-0x000007FEAEF90000-0x000007FEAEF9A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1508-54-0x00000000757E1000-0x00000000757E3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1508-56-0x0000000000220000-0x0000000000229000-memory.dmp
    Filesize

    36KB

    Download
  • memory/1508-55-0x00000000006FE000-0x0000000000713000-memory.dmp
    Filesize

    84KB

    Download
  • memory/1508-57-0x0000000000400000-0x00000000005BC000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/1508-58-0x0000000000400000-0x00000000005BC000-memory.dmp
    Filesize

    1.7MB

    Download