Analysis
-
max time kernel
150s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
17-02-2023 01:25
Static task
static1
Behavioral task
behavioral1
Sample
bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exe
Resource
win7-20221111-en
General
-
Target
bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exe
-
Size
206KB
-
MD5
9ed1c8993f53fd472011635dccbd50e7
-
SHA1
1c84a1127773886a5f2f9a039c02b91e88b50ef1
-
SHA256
bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e
-
SHA512
4487c37818e66b65ea7d72ddf90f67ad5fba7fdd5669857bbf27333a1276bcf59d4de7d647bfcf834fb8ee546aa1e233ba8a4c6d10310fa4fd1c1d21123db286
-
SSDEEP
3072:iG4O89gVqv36nUrC6sqhhV9XZlA1JgbCF69ap89xgLxuHG2hTGWM:iHOtYKUr9rhhfXXeJgnly2
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/852-57-0x00000000003A0000-0x00000000003A9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exepid process 852 bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exe 852 bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exe 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1244 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exepid process 852 bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exe"C:\Users\Admin\AppData\Local\Temp\bc91758c889d767811e1051d9d43d99a12d91a1ec2cbe08d8fec78228fe1e54e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/852-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/852-56-0x0000000000230000-0x0000000000330000-memory.dmpFilesize
1024KB
-
memory/852-57-0x00000000003A0000-0x00000000003A9000-memory.dmpFilesize
36KB
-
memory/852-58-0x0000000000400000-0x0000000000567000-memory.dmpFilesize
1.4MB
-
memory/852-59-0x0000000000400000-0x0000000000567000-memory.dmpFilesize
1.4MB