Analysis
-
max time kernel
159s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08/03/2023, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe
Resource
win7-20230220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe
-
Size
321KB
-
MD5
b7899dd9a9e96c03d4ff14e46017ca7b
-
SHA1
4bed366ac4f40d4e80d8030baa33c015d45b016a
-
SHA256
a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e
-
SHA512
45f43d8da45fc24a9b0937c373d25bd0c742e90fb69fa2b007e387fa83274a35e7bc77dae35f36890e6809019ea251094134b555bee7bdc13aa0c550918f2ef6
-
SSDEEP
3072:juuIWqRwPv8LWdaEKiPGAuus/0ooFWBYyYXQEUjnU1bvKnJEtcOF:5q68LWTKiN80oMWFfEsyvKJ
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://host-file-host6.com/
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
-
Detects Smokeloader packer 4 IoCs
resource yara_rule behavioral1/memory/2012-56-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2020-57-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader behavioral1/memory/2012-58-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2012-60-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2020 set thread context of 2012 2020 a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe 28 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2012 a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe 2012 a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1264 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2012 a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2012 2020 a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe 28 PID 2020 wrote to memory of 2012 2020 a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe 28 PID 2020 wrote to memory of 2012 2020 a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe 28 PID 2020 wrote to memory of 2012 2020 a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe 28 PID 2020 wrote to memory of 2012 2020 a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe 28 PID 2020 wrote to memory of 2012 2020 a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe 28 PID 2020 wrote to memory of 2012 2020 a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe"C:\Users\Admin\AppData\Local\Temp\a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe"C:\Users\Admin\AppData\Local\Temp\a7e3cfa1a45329cef508f67fa70f572bf9f4b50368934a5ac6f2ad98b637927e.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2012
-