Analysis
-
max time kernel
151s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 19:34
Static task
static1
Behavioral task
behavioral1
Sample
c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe
Resource
win10-en-20211208
General
-
Target
c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe
-
Size
190KB
-
MD5
3ba395916975f382badb22bdc868b3de
-
SHA1
5dd31e44d30ceeded8a6588f0c53492d56a06f49
-
SHA256
c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a
-
SHA512
6797c105b2609b320ff3be96d5e9d0d093925cc33e5c3eb503bda5d9e65ffaed67ae4bf08e8a43dbca558d1c3f413c3ede7df33b812598386ec10cb1d3de6838
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
sdgwcrusdgwcrupid process 2236 sdgwcru 3960 sdgwcru -
Deletes itself 1 IoCs
Processes:
pid process 3064 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exesdgwcrudescription pid process target process PID 1188 set thread context of 512 1188 c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe PID 2236 set thread context of 3960 2236 sdgwcru sdgwcru -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exesdgwcrudescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sdgwcru Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sdgwcru Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sdgwcru Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exepid process 512 c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe 512 c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3064 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exesdgwcrupid process 512 c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe 3960 sdgwcru -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exesdgwcrudescription pid process target process PID 1188 wrote to memory of 512 1188 c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe PID 1188 wrote to memory of 512 1188 c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe PID 1188 wrote to memory of 512 1188 c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe PID 1188 wrote to memory of 512 1188 c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe PID 1188 wrote to memory of 512 1188 c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe PID 1188 wrote to memory of 512 1188 c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe PID 2236 wrote to memory of 3960 2236 sdgwcru sdgwcru PID 2236 wrote to memory of 3960 2236 sdgwcru sdgwcru PID 2236 wrote to memory of 3960 2236 sdgwcru sdgwcru PID 2236 wrote to memory of 3960 2236 sdgwcru sdgwcru PID 2236 wrote to memory of 3960 2236 sdgwcru sdgwcru PID 2236 wrote to memory of 3960 2236 sdgwcru sdgwcru
Processes
-
C:\Users\Admin\AppData\Local\Temp\c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe"C:\Users\Admin\AppData\Local\Temp\c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe"C:\Users\Admin\AppData\Local\Temp\c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\sdgwcruC:\Users\Admin\AppData\Roaming\sdgwcru1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\sdgwcruC:\Users\Admin\AppData\Roaming\sdgwcru2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\sdgwcruMD5
3ba395916975f382badb22bdc868b3de
SHA15dd31e44d30ceeded8a6588f0c53492d56a06f49
SHA256c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a
SHA5126797c105b2609b320ff3be96d5e9d0d093925cc33e5c3eb503bda5d9e65ffaed67ae4bf08e8a43dbca558d1c3f413c3ede7df33b812598386ec10cb1d3de6838
-
C:\Users\Admin\AppData\Roaming\sdgwcruMD5
3ba395916975f382badb22bdc868b3de
SHA15dd31e44d30ceeded8a6588f0c53492d56a06f49
SHA256c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a
SHA5126797c105b2609b320ff3be96d5e9d0d093925cc33e5c3eb503bda5d9e65ffaed67ae4bf08e8a43dbca558d1c3f413c3ede7df33b812598386ec10cb1d3de6838
-
C:\Users\Admin\AppData\Roaming\sdgwcruMD5
3ba395916975f382badb22bdc868b3de
SHA15dd31e44d30ceeded8a6588f0c53492d56a06f49
SHA256c00192be5bba695b4e38f75e42b05837278f5317c559219b03f9076e29b3817a
SHA5126797c105b2609b320ff3be96d5e9d0d093925cc33e5c3eb503bda5d9e65ffaed67ae4bf08e8a43dbca558d1c3f413c3ede7df33b812598386ec10cb1d3de6838
-
memory/512-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/512-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1188-115-0x00000000007A0000-0x00000000007C3000-memory.dmpFilesize
140KB
-
memory/1188-117-0x0000000002150000-0x0000000002159000-memory.dmpFilesize
36KB
-
memory/2236-122-0x00000000006C0000-0x00000000006E4000-memory.dmpFilesize
144KB
-
memory/3064-119-0x0000000000F80000-0x0000000000F96000-memory.dmpFilesize
88KB
-
memory/3064-126-0x0000000000FA0000-0x0000000000FB6000-memory.dmpFilesize
88KB
-
memory/3960-125-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB