11ac8b313e17391ba1c40d40d400b477bbc4bd48fc72967e308899319c9ec7bf

Analysis

max time kernel
1798s
max time network
1819s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 17:02

Target

BotNets/SmokeBot/Builder.exe
Size

150KB
MD5

a9fbbab787268d6b6b7591c731994cde
SHA1

eff857cce9a252470b80b63710226058bc9d2c9c
SHA256

fc7a97e7bf86c69a409c1211dddc4e97cbc109ffd4a8d1a13ff3b9aab9b9d0f9
SHA512

d6ce3a60c0b3b2df9d07adb68e2578f7fabb97a7ccc370cd0871fe23d299f6e7251869d380dbd2561d35972131995a41dacacfdeba4c2ec3d0c9da1a21161ccc
SSDEEP

3072:roOzSNRh6+Cs7nKCageYQ+f5keXt3RI7VlFtYtrdi9ddDojSLR205Pbt:cA+57KCaget+f5ky3QVlwtrdir9oM/x

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x0000000000465000-memory.dmp	upx
behavioral1/memory/2200-2-0x0000000000400000-0x0000000000465000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Builder.exe

pid process

2200 Builder.exe

pid	process
2200	Builder.exe

C:\Users\Admin\AppData\Local\Temp\BotNets\SmokeBot\Builder.exe
"C:\Users\Admin\AppData\Local\Temp\BotNets\SmokeBot\Builder.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2200

memory/2200-0-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2200-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2200-2-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2200-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download