Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
04-12-2021 10:17
Static task
static1
Behavioral task
behavioral1
Sample
9edd0c32df4680a4e55c73b43e0900b0.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
9edd0c32df4680a4e55c73b43e0900b0.exe
Resource
win10-en-20211014
General
-
Target
9edd0c32df4680a4e55c73b43e0900b0.exe
-
Size
249KB
-
MD5
9edd0c32df4680a4e55c73b43e0900b0
-
SHA1
38a7e4e7c359391d844b67e329fba51f5bb6de71
-
SHA256
58674ac34f75b675fa37d2f837107a70780df7b81de872b518963a00de501a4b
-
SHA512
9cf7b309a75a4e463d8200f7c9ffc23e43f622d51e236a589ef537d5f841a674fe60fcfbbaf3f6c9402ce00227b2f5610e8cc641c182998d1804b90377f3366d
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
770.exepid process 956 770.exe -
Deletes itself 1 IoCs
Processes:
pid process 1352 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9edd0c32df4680a4e55c73b43e0900b0.exedescription pid process target process PID 1424 set thread context of 728 1424 9edd0c32df4680a4e55c73b43e0900b0.exe 9edd0c32df4680a4e55c73b43e0900b0.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
770.exe9edd0c32df4680a4e55c73b43e0900b0.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 770.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9edd0c32df4680a4e55c73b43e0900b0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9edd0c32df4680a4e55c73b43e0900b0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9edd0c32df4680a4e55c73b43e0900b0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 770.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 770.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9edd0c32df4680a4e55c73b43e0900b0.exepid process 728 9edd0c32df4680a4e55c73b43e0900b0.exe 728 9edd0c32df4680a4e55c73b43e0900b0.exe 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1352 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
9edd0c32df4680a4e55c73b43e0900b0.exe770.exepid process 728 9edd0c32df4680a4e55c73b43e0900b0.exe 956 770.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1352 1352 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1352 1352 -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
9edd0c32df4680a4e55c73b43e0900b0.exedescription pid process target process PID 1424 wrote to memory of 728 1424 9edd0c32df4680a4e55c73b43e0900b0.exe 9edd0c32df4680a4e55c73b43e0900b0.exe PID 1424 wrote to memory of 728 1424 9edd0c32df4680a4e55c73b43e0900b0.exe 9edd0c32df4680a4e55c73b43e0900b0.exe PID 1424 wrote to memory of 728 1424 9edd0c32df4680a4e55c73b43e0900b0.exe 9edd0c32df4680a4e55c73b43e0900b0.exe PID 1424 wrote to memory of 728 1424 9edd0c32df4680a4e55c73b43e0900b0.exe 9edd0c32df4680a4e55c73b43e0900b0.exe PID 1424 wrote to memory of 728 1424 9edd0c32df4680a4e55c73b43e0900b0.exe 9edd0c32df4680a4e55c73b43e0900b0.exe PID 1424 wrote to memory of 728 1424 9edd0c32df4680a4e55c73b43e0900b0.exe 9edd0c32df4680a4e55c73b43e0900b0.exe PID 1424 wrote to memory of 728 1424 9edd0c32df4680a4e55c73b43e0900b0.exe 9edd0c32df4680a4e55c73b43e0900b0.exe PID 1352 wrote to memory of 956 1352 770.exe PID 1352 wrote to memory of 956 1352 770.exe PID 1352 wrote to memory of 956 1352 770.exe PID 1352 wrote to memory of 956 1352 770.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9edd0c32df4680a4e55c73b43e0900b0.exe"C:\Users\Admin\AppData\Local\Temp\9edd0c32df4680a4e55c73b43e0900b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9edd0c32df4680a4e55c73b43e0900b0.exe"C:\Users\Admin\AppData\Local\Temp\9edd0c32df4680a4e55c73b43e0900b0.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\770.exeC:\Users\Admin\AppData\Local\Temp\770.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\770.exeMD5
df13fac0d8b182e4d8b9a02ba87a9571
SHA1b2187debc6fde96e08d5014ce4f1af5cf568bce5
SHA256af64f5b2b6c4cc63b0ca4bb48f369eba1629886d85e289a469a5c9612c4a5ee3
SHA512bc842a80509bda8afff6e12f5b5c64ccf7f1d7360f99f63cebbc1f21936a15487ec16bde3c2acff22c49ebcedf5c426621d6f69503f4968aacc8e75611e3a816
-
memory/728-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/728-57-0x0000000000402F47-mapping.dmp
-
memory/728-58-0x0000000075D31000-0x0000000075D33000-memory.dmpFilesize
8KB
-
memory/956-61-0x0000000000000000-mapping.dmp
-
memory/956-65-0x0000000000230000-0x0000000000239000-memory.dmpFilesize
36KB
-
memory/956-64-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/956-66-0x0000000000400000-0x0000000002B64000-memory.dmpFilesize
39.4MB
-
memory/1352-60-0x0000000001DD0000-0x0000000001DE6000-memory.dmpFilesize
88KB
-
memory/1352-67-0x0000000003960000-0x0000000003976000-memory.dmpFilesize
88KB
-
memory/1424-55-0x00000000005BB000-0x00000000005C4000-memory.dmpFilesize
36KB
-
memory/1424-59-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB