Analysis
-
max time kernel
153s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 05:08
Static task
static1
Behavioral task
behavioral1
Sample
01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe
Resource
win10-en-20211208
General
-
Target
01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe
-
Size
333KB
-
MD5
81977e49638a8e8512466521b3907ebf
-
SHA1
ef04db6fa35033a7c5962b4a5bf0edc29304cd53
-
SHA256
01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd
-
SHA512
aa6613cf02406ba67cee103c53e02093667cab49255ab2c7bdba4da63a1061398d5cb689fe0f2bbce56a74900122e2fb524170a78fbb632ce1a0eebd0bdc1735
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2892 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exedescription pid process target process PID 2568 set thread context of 2844 2568 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exepid process 2844 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe 2844 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2892 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exepid process 2844 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exedescription pid process target process PID 2568 wrote to memory of 2844 2568 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe PID 2568 wrote to memory of 2844 2568 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe PID 2568 wrote to memory of 2844 2568 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe PID 2568 wrote to memory of 2844 2568 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe PID 2568 wrote to memory of 2844 2568 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe PID 2568 wrote to memory of 2844 2568 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe 01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe"C:\Users\Admin\AppData\Local\Temp\01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe"C:\Users\Admin\AppData\Local\Temp\01bae7437041c044adf52438b49af874482298db7b5e88143c9e6f8ede393abd.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection