Analysis
-
max time kernel
151s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-12-2021 04:08
Static task
static1
Behavioral task
behavioral1
Sample
363f884437ae8e4af273fe471085f960.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
363f884437ae8e4af273fe471085f960.exe
Resource
win10-en-20211208
General
-
Target
363f884437ae8e4af273fe471085f960.exe
-
Size
291KB
-
MD5
363f884437ae8e4af273fe471085f960
-
SHA1
1e4ecbbea9e8b5c2eb58cf6da72d4356e116b8b2
-
SHA256
03932a45a4930fa81f20cea4598a9845262d89ff410d23f28731235a898a22a1
-
SHA512
ee09a8309c343e198a2cc8816df332a1b5dea3936d9d03f9daeb92a2d8c6fa66c0a8128e8691a39b0669642db8e5b881140d105e80db8fe576d366a535e737aa
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
vdtuhdavdtuhdapid process 828 vdtuhda 1220 vdtuhda -
Deletes itself 1 IoCs
Processes:
pid process 1248 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
363f884437ae8e4af273fe471085f960.exevdtuhdadescription pid process target process PID 1672 set thread context of 964 1672 363f884437ae8e4af273fe471085f960.exe 363f884437ae8e4af273fe471085f960.exe PID 828 set thread context of 1220 828 vdtuhda vdtuhda -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
363f884437ae8e4af273fe471085f960.exevdtuhdadescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 363f884437ae8e4af273fe471085f960.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 363f884437ae8e4af273fe471085f960.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 363f884437ae8e4af273fe471085f960.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vdtuhda Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vdtuhda Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vdtuhda -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
363f884437ae8e4af273fe471085f960.exepid process 964 363f884437ae8e4af273fe471085f960.exe 964 363f884437ae8e4af273fe471085f960.exe 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1248 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
363f884437ae8e4af273fe471085f960.exevdtuhdapid process 964 363f884437ae8e4af273fe471085f960.exe 1220 vdtuhda -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1248 1248 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1248 1248 -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
363f884437ae8e4af273fe471085f960.exetaskeng.exevdtuhdadescription pid process target process PID 1672 wrote to memory of 964 1672 363f884437ae8e4af273fe471085f960.exe 363f884437ae8e4af273fe471085f960.exe PID 1672 wrote to memory of 964 1672 363f884437ae8e4af273fe471085f960.exe 363f884437ae8e4af273fe471085f960.exe PID 1672 wrote to memory of 964 1672 363f884437ae8e4af273fe471085f960.exe 363f884437ae8e4af273fe471085f960.exe PID 1672 wrote to memory of 964 1672 363f884437ae8e4af273fe471085f960.exe 363f884437ae8e4af273fe471085f960.exe PID 1672 wrote to memory of 964 1672 363f884437ae8e4af273fe471085f960.exe 363f884437ae8e4af273fe471085f960.exe PID 1672 wrote to memory of 964 1672 363f884437ae8e4af273fe471085f960.exe 363f884437ae8e4af273fe471085f960.exe PID 1672 wrote to memory of 964 1672 363f884437ae8e4af273fe471085f960.exe 363f884437ae8e4af273fe471085f960.exe PID 976 wrote to memory of 828 976 taskeng.exe vdtuhda PID 976 wrote to memory of 828 976 taskeng.exe vdtuhda PID 976 wrote to memory of 828 976 taskeng.exe vdtuhda PID 976 wrote to memory of 828 976 taskeng.exe vdtuhda PID 828 wrote to memory of 1220 828 vdtuhda vdtuhda PID 828 wrote to memory of 1220 828 vdtuhda vdtuhda PID 828 wrote to memory of 1220 828 vdtuhda vdtuhda PID 828 wrote to memory of 1220 828 vdtuhda vdtuhda PID 828 wrote to memory of 1220 828 vdtuhda vdtuhda PID 828 wrote to memory of 1220 828 vdtuhda vdtuhda PID 828 wrote to memory of 1220 828 vdtuhda vdtuhda
Processes
-
C:\Users\Admin\AppData\Local\Temp\363f884437ae8e4af273fe471085f960.exe"C:\Users\Admin\AppData\Local\Temp\363f884437ae8e4af273fe471085f960.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\363f884437ae8e4af273fe471085f960.exe"C:\Users\Admin\AppData\Local\Temp\363f884437ae8e4af273fe471085f960.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {C77CAB9D-3CF9-48D1-8680-F9F86E391E5B} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vdtuhdaC:\Users\Admin\AppData\Roaming\vdtuhda2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vdtuhdaC:\Users\Admin\AppData\Roaming\vdtuhda3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\vdtuhdaMD5
363f884437ae8e4af273fe471085f960
SHA11e4ecbbea9e8b5c2eb58cf6da72d4356e116b8b2
SHA25603932a45a4930fa81f20cea4598a9845262d89ff410d23f28731235a898a22a1
SHA512ee09a8309c343e198a2cc8816df332a1b5dea3936d9d03f9daeb92a2d8c6fa66c0a8128e8691a39b0669642db8e5b881140d105e80db8fe576d366a535e737aa
-
C:\Users\Admin\AppData\Roaming\vdtuhdaMD5
363f884437ae8e4af273fe471085f960
SHA11e4ecbbea9e8b5c2eb58cf6da72d4356e116b8b2
SHA25603932a45a4930fa81f20cea4598a9845262d89ff410d23f28731235a898a22a1
SHA512ee09a8309c343e198a2cc8816df332a1b5dea3936d9d03f9daeb92a2d8c6fa66c0a8128e8691a39b0669642db8e5b881140d105e80db8fe576d366a535e737aa
-
C:\Users\Admin\AppData\Roaming\vdtuhdaMD5
363f884437ae8e4af273fe471085f960
SHA11e4ecbbea9e8b5c2eb58cf6da72d4356e116b8b2
SHA25603932a45a4930fa81f20cea4598a9845262d89ff410d23f28731235a898a22a1
SHA512ee09a8309c343e198a2cc8816df332a1b5dea3936d9d03f9daeb92a2d8c6fa66c0a8128e8691a39b0669642db8e5b881140d105e80db8fe576d366a535e737aa
-
memory/828-63-0x000000000060B000-0x000000000061C000-memory.dmpFilesize
68KB
-
memory/828-61-0x0000000000000000-mapping.dmp
-
memory/964-57-0x0000000075341000-0x0000000075343000-memory.dmpFilesize
8KB
-
memory/964-55-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/964-56-0x0000000000402F47-mapping.dmp
-
memory/1220-65-0x0000000000402F47-mapping.dmp
-
memory/1248-59-0x0000000002960000-0x0000000002976000-memory.dmpFilesize
88KB
-
memory/1248-68-0x0000000002990000-0x00000000029A6000-memory.dmpFilesize
88KB
-
memory/1672-58-0x0000000000230000-0x0000000000239000-memory.dmpFilesize
36KB
-
memory/1672-54-0x000000000061B000-0x000000000062C000-memory.dmpFilesize
68KB