Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 01:03
Static task
static1
Behavioral task
behavioral1
Sample
88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe
Resource
win10-en-20211208
General
-
Target
88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe
-
Size
356KB
-
MD5
22eb12e34b7fe6eb3cbf8a0af69c05f9
-
SHA1
c6b4278662291d0c8077b87e493e1fd1c34c129a
-
SHA256
88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1
-
SHA512
f71698cad8a6207a5d54d5d97f90f36449097ce32fae607e3b7d1a470886afea420a265ab380305cabc997fe80ef202d39c188be85b68340c671056f83f06685
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
bvdjtgebvdjtgepid process 1160 bvdjtge 776 bvdjtge -
Deletes itself 1 IoCs
Processes:
pid process 3064 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exebvdjtgedescription pid process target process PID 3004 set thread context of 600 3004 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe PID 1160 set thread context of 776 1160 bvdjtge bvdjtge -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
bvdjtge88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bvdjtge Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bvdjtge Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bvdjtge -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exepid process 600 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe 600 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3064 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exebvdjtgepid process 600 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe 776 bvdjtge -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exebvdjtgedescription pid process target process PID 3004 wrote to memory of 600 3004 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe PID 3004 wrote to memory of 600 3004 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe PID 3004 wrote to memory of 600 3004 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe PID 3004 wrote to memory of 600 3004 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe PID 3004 wrote to memory of 600 3004 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe PID 3004 wrote to memory of 600 3004 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe 88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe PID 1160 wrote to memory of 776 1160 bvdjtge bvdjtge PID 1160 wrote to memory of 776 1160 bvdjtge bvdjtge PID 1160 wrote to memory of 776 1160 bvdjtge bvdjtge PID 1160 wrote to memory of 776 1160 bvdjtge bvdjtge PID 1160 wrote to memory of 776 1160 bvdjtge bvdjtge PID 1160 wrote to memory of 776 1160 bvdjtge bvdjtge
Processes
-
C:\Users\Admin\AppData\Local\Temp\88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe"C:\Users\Admin\AppData\Local\Temp\88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe"C:\Users\Admin\AppData\Local\Temp\88001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\bvdjtgeC:\Users\Admin\AppData\Roaming\bvdjtge1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\bvdjtgeC:\Users\Admin\AppData\Roaming\bvdjtge2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\bvdjtgeMD5
22eb12e34b7fe6eb3cbf8a0af69c05f9
SHA1c6b4278662291d0c8077b87e493e1fd1c34c129a
SHA25688001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1
SHA512f71698cad8a6207a5d54d5d97f90f36449097ce32fae607e3b7d1a470886afea420a265ab380305cabc997fe80ef202d39c188be85b68340c671056f83f06685
-
C:\Users\Admin\AppData\Roaming\bvdjtgeMD5
22eb12e34b7fe6eb3cbf8a0af69c05f9
SHA1c6b4278662291d0c8077b87e493e1fd1c34c129a
SHA25688001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1
SHA512f71698cad8a6207a5d54d5d97f90f36449097ce32fae607e3b7d1a470886afea420a265ab380305cabc997fe80ef202d39c188be85b68340c671056f83f06685
-
C:\Users\Admin\AppData\Roaming\bvdjtgeMD5
22eb12e34b7fe6eb3cbf8a0af69c05f9
SHA1c6b4278662291d0c8077b87e493e1fd1c34c129a
SHA25688001120ed17ade8fb6c15764081a9e222845c03ace7d305bf24232080036de1
SHA512f71698cad8a6207a5d54d5d97f90f36449097ce32fae607e3b7d1a470886afea420a265ab380305cabc997fe80ef202d39c188be85b68340c671056f83f06685
-
memory/600-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/600-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/776-126-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1160-125-0x00000000005E0000-0x00000000005E9000-memory.dmpFilesize
36KB
-
memory/3004-116-0x0000000000490000-0x000000000053E000-memory.dmpFilesize
696KB
-
memory/3064-119-0x0000000000F80000-0x0000000000F96000-memory.dmpFilesize
88KB
-
memory/3064-127-0x0000000000FA0000-0x0000000000FB6000-memory.dmpFilesize
88KB