Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 09:15
Static task
static1
Behavioral task
behavioral1
Sample
b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe
Resource
win10-en-20211208
General
-
Target
b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe
-
Size
241KB
-
MD5
3e0b102e4d7aa343f22722dcfd45b1db
-
SHA1
82e1feb7d38edc7acf37f82f81ac097910273855
-
SHA256
b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6
-
SHA512
e6c6d453365f0ad99d1314e9d7da63dd76f67bac40ed0f4fe132a273ad7899f8c15d8e790767260aa0aacdbc01d03bc784e826c799f87dcd40030fff291acbb6
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3064 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exedescription pid process target process PID 3148 set thread context of 928 3148 b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exepid process 928 b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe 928 b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3064 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exepid process 928 b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exedescription pid process target process PID 3148 wrote to memory of 928 3148 b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe PID 3148 wrote to memory of 928 3148 b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe PID 3148 wrote to memory of 928 3148 b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe PID 3148 wrote to memory of 928 3148 b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe PID 3148 wrote to memory of 928 3148 b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe PID 3148 wrote to memory of 928 3148 b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe"C:\Users\Admin\AppData\Local\Temp\b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe"C:\Users\Admin\AppData\Local\Temp\b915341c8ab3cd166346f95e1b0fec902fabb6e4f7a7746abb5c2eebf848b6c6.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection