Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
07/12/2021, 23:47
Static task
static1
Behavioral task
behavioral1
Sample
a4822c960055c8c34fcc130bae6f0d86.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
a4822c960055c8c34fcc130bae6f0d86.exe
Resource
win10-en-20211104
General
-
Target
a4822c960055c8c34fcc130bae6f0d86.exe
-
Size
319KB
-
MD5
a4822c960055c8c34fcc130bae6f0d86
-
SHA1
bd5f62284b8c1c905a72b3c7f66240a4704e1bfa
-
SHA256
f6401919fd20e698ec964ca0df4eee18c1f13852eef32a9246fe4605cff79969
-
SHA512
7bb794fddd9d43483ddf17d4d1a8957db6044d4d4d8271f3c3631b416c0bb788e61ddb2a8a0ea16bbe3d0baa416534b4e8e475628e38bb08922c62f4cae45061
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1124 453A.exe -
Deletes itself 1 IoCs
pid Process 1276 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1916 set thread context of 2040 1916 a4822c960055c8c34fcc130bae6f0d86.exe 28 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a4822c960055c8c34fcc130bae6f0d86.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a4822c960055c8c34fcc130bae6f0d86.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a4822c960055c8c34fcc130bae6f0d86.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2040 a4822c960055c8c34fcc130bae6f0d86.exe 2040 a4822c960055c8c34fcc130bae6f0d86.exe 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1276 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2040 a4822c960055c8c34fcc130bae6f0d86.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1276 Process not Found 1276 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1276 Process not Found 1276 Process not Found -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2040 1916 a4822c960055c8c34fcc130bae6f0d86.exe 28 PID 1916 wrote to memory of 2040 1916 a4822c960055c8c34fcc130bae6f0d86.exe 28 PID 1916 wrote to memory of 2040 1916 a4822c960055c8c34fcc130bae6f0d86.exe 28 PID 1916 wrote to memory of 2040 1916 a4822c960055c8c34fcc130bae6f0d86.exe 28 PID 1916 wrote to memory of 2040 1916 a4822c960055c8c34fcc130bae6f0d86.exe 28 PID 1916 wrote to memory of 2040 1916 a4822c960055c8c34fcc130bae6f0d86.exe 28 PID 1916 wrote to memory of 2040 1916 a4822c960055c8c34fcc130bae6f0d86.exe 28 PID 1276 wrote to memory of 1124 1276 Process not Found 29 PID 1276 wrote to memory of 1124 1276 Process not Found 29 PID 1276 wrote to memory of 1124 1276 Process not Found 29 PID 1276 wrote to memory of 1124 1276 Process not Found 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4822c960055c8c34fcc130bae6f0d86.exe"C:\Users\Admin\AppData\Local\Temp\a4822c960055c8c34fcc130bae6f0d86.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\a4822c960055c8c34fcc130bae6f0d86.exe"C:\Users\Admin\AppData\Local\Temp\a4822c960055c8c34fcc130bae6f0d86.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\453A.exeC:\Users\Admin\AppData\Local\Temp\453A.exe1⤵
- Executes dropped EXE
PID:1124