11ac8b313e17391ba1c40d40d400b477bbc4bd48fc72967e308899319c9ec7bf

Analysis

max time kernel
1798s
max time network
1819s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 17:02

Target
BotNets/SmokeBot/Builder.exe
Size 150KB
Sample240404-vkchlsdg73
SHA256 fc7a97e7bf86c69a409c1211dddc4e97cbc109ffd4a8d1a13ff3b9aab9b9d0f9
MD5 a9fbbab787268d6b6b7591c731994cde
SHA1 eff857cce9a252470b80b63710226058bc9d2c9c
SHA512 d6ce3a60c0b3b2df9d07adb68e2578f7fabb97a7ccc370cd0871fe23d299f6e7251869d380dbd2561d35972131995a41dacacfdeba4c2ec3d0c9da1a21161ccc
SSDEEP 3072:roOzSNRh6+Cs7nKCageYQ+f5keXt3RI7VlFtYtrdi9ddDojSLR205Pbt:cA+57KCaget+f5ky3QVlwtrdir9oM/x
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x0000000000465000-memory.dmp	upx
behavioral1/memory/2200-2-0x0000000000400000-0x0000000000465000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2200	Builder.exe

C:\Users\Admin\AppData\Local\Temp\BotNets\SmokeBot\Builder.exe
"C:\Users\Admin\AppData\Local\Temp\BotNets\SmokeBot\Builder.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2200

memory/2200-0-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/2200-1-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2200-2-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/2200-4-0x0000000000220000-0x0000000000221000-memory.dmp

Download