Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17-02-2023 22:26
Static task
static1
Behavioral task
behavioral1
Sample
0eae001edceff3bc23cadaae071dfc32.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0eae001edceff3bc23cadaae071dfc32.exe
Resource
win10v2004-20220812-en
General
-
Target
0eae001edceff3bc23cadaae071dfc32.exe
-
Size
206KB
-
MD5
0eae001edceff3bc23cadaae071dfc32
-
SHA1
5d387a67ba534fd143eaea2730ad0a15e020e7e4
-
SHA256
41b4cc711899e88e5a7ddc2977d9f817f230e4186841a0d26bd66f26281562b6
-
SHA512
d6ffbacae4a9c0e0d448bad7686e7418e4e19cc77eaff39c55a02b3f7d3ce264f290dd55231281439e98e935b7f08a20ad10686a52a210c094c791f92811ee7f
-
SSDEEP
6144:i7ziNNyACm+SVpiHIu8v/1Z94630C8Ot1:+zD1m+SPiH58vdZ9J3Pt
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/112-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
0eae001edceff3bc23cadaae071dfc32.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0eae001edceff3bc23cadaae071dfc32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0eae001edceff3bc23cadaae071dfc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0eae001edceff3bc23cadaae071dfc32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0eae001edceff3bc23cadaae071dfc32.exepid process 112 0eae001edceff3bc23cadaae071dfc32.exe 112 0eae001edceff3bc23cadaae071dfc32.exe 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0eae001edceff3bc23cadaae071dfc32.exepid process 112 0eae001edceff3bc23cadaae071dfc32.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/112-54-0x0000000075E31000-0x0000000075E33000-memory.dmpFilesize
8KB
-
memory/112-55-0x00000000009CE000-0x00000000009E1000-memory.dmpFilesize
76KB
-
memory/112-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/112-57-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/112-58-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB