Analysis
-
max time kernel
164s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 22:48
Static task
static1
Behavioral task
behavioral1
Sample
e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe
Resource
win10-en-20211208
General
-
Target
e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe
-
Size
189KB
-
MD5
9ecba0f31f2adf6df2d580f853b725bc
-
SHA1
021cd7c797db390130fc4e233175954f126a979d
-
SHA256
e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09
-
SHA512
9bd9c843e92897a101e559b87a0d7c7bb772e03b70351835177bccbe10f2dba3b276bd147f09da3a64426a349b59f51e9341ced70ccf4c1fbe7b040fb1bf48a4
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
cruhuhfcruhuhfpid process 1404 cruhuhf 1460 cruhuhf -
Deletes itself 1 IoCs
Processes:
pid process 3040 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.execruhuhfdescription pid process target process PID 2580 set thread context of 3824 2580 e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe PID 1404 set thread context of 1460 1404 cruhuhf cruhuhf -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.execruhuhfdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cruhuhf Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cruhuhf Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cruhuhf -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exepid process 3824 e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe 3824 e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3040 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.execruhuhfpid process 3824 e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe 1460 cruhuhf -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.execruhuhfdescription pid process target process PID 2580 wrote to memory of 3824 2580 e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe PID 2580 wrote to memory of 3824 2580 e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe PID 2580 wrote to memory of 3824 2580 e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe PID 2580 wrote to memory of 3824 2580 e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe PID 2580 wrote to memory of 3824 2580 e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe PID 2580 wrote to memory of 3824 2580 e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe PID 1404 wrote to memory of 1460 1404 cruhuhf cruhuhf PID 1404 wrote to memory of 1460 1404 cruhuhf cruhuhf PID 1404 wrote to memory of 1460 1404 cruhuhf cruhuhf PID 1404 wrote to memory of 1460 1404 cruhuhf cruhuhf PID 1404 wrote to memory of 1460 1404 cruhuhf cruhuhf PID 1404 wrote to memory of 1460 1404 cruhuhf cruhuhf
Processes
-
C:\Users\Admin\AppData\Local\Temp\e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe"C:\Users\Admin\AppData\Local\Temp\e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe"C:\Users\Admin\AppData\Local\Temp\e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\cruhuhfC:\Users\Admin\AppData\Roaming\cruhuhf1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cruhuhfC:\Users\Admin\AppData\Roaming\cruhuhf2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\cruhuhfMD5
9ecba0f31f2adf6df2d580f853b725bc
SHA1021cd7c797db390130fc4e233175954f126a979d
SHA256e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09
SHA5129bd9c843e92897a101e559b87a0d7c7bb772e03b70351835177bccbe10f2dba3b276bd147f09da3a64426a349b59f51e9341ced70ccf4c1fbe7b040fb1bf48a4
-
C:\Users\Admin\AppData\Roaming\cruhuhfMD5
9ecba0f31f2adf6df2d580f853b725bc
SHA1021cd7c797db390130fc4e233175954f126a979d
SHA256e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09
SHA5129bd9c843e92897a101e559b87a0d7c7bb772e03b70351835177bccbe10f2dba3b276bd147f09da3a64426a349b59f51e9341ced70ccf4c1fbe7b040fb1bf48a4
-
C:\Users\Admin\AppData\Roaming\cruhuhfMD5
9ecba0f31f2adf6df2d580f853b725bc
SHA1021cd7c797db390130fc4e233175954f126a979d
SHA256e39cd79aa737bae33312424db118f021e2f02ff2de0f9721c54356f1af340e09
SHA5129bd9c843e92897a101e559b87a0d7c7bb772e03b70351835177bccbe10f2dba3b276bd147f09da3a64426a349b59f51e9341ced70ccf4c1fbe7b040fb1bf48a4
-
memory/1460-125-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2580-116-0x0000000000610000-0x0000000000634000-memory.dmpFilesize
144KB
-
memory/3040-119-0x00000000005C0000-0x00000000005D6000-memory.dmpFilesize
88KB
-
memory/3040-126-0x0000000000710000-0x0000000000726000-memory.dmpFilesize
88KB
-
memory/3824-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3824-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB