Analysis
-
max time kernel
167s -
max time network
157s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 13:30
Static task
static1
Behavioral task
behavioral1
Sample
98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe
Resource
win10-en-20211208
General
-
Target
98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe
-
Size
352KB
-
MD5
f43e2e9f0b18e32408c3e4d628ea0f74
-
SHA1
90433a3494e734fa0a14441906302b60ded3f591
-
SHA256
98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8
-
SHA512
fc149cdee4e540117d1413729a98bfa50bf237ea007d14ceaaa2275ad87cdcbfc2863dbfca940bde8d69f5f2bd0a90680d17e27c434f551af6a9f9294f3917a3
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3024 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exedescription pid process target process PID 4024 set thread context of 3432 4024 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exepid process 3432 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe 3432 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3024 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exepid process 3432 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exedescription pid process target process PID 4024 wrote to memory of 3432 4024 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe PID 4024 wrote to memory of 3432 4024 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe PID 4024 wrote to memory of 3432 4024 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe PID 4024 wrote to memory of 3432 4024 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe PID 4024 wrote to memory of 3432 4024 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe PID 4024 wrote to memory of 3432 4024 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe 98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe"C:\Users\Admin\AppData\Local\Temp\98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe"C:\Users\Admin\AppData\Local\Temp\98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection