Analysis
-
max time kernel
152s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 14:27
Static task
static1
Behavioral task
behavioral1
Sample
f43e2e9f0b18e32408c3e4d628ea0f74.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f43e2e9f0b18e32408c3e4d628ea0f74.exe
Resource
win10-en-20211208
General
-
Target
f43e2e9f0b18e32408c3e4d628ea0f74.exe
-
Size
352KB
-
MD5
f43e2e9f0b18e32408c3e4d628ea0f74
-
SHA1
90433a3494e734fa0a14441906302b60ded3f591
-
SHA256
98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8
-
SHA512
fc149cdee4e540117d1413729a98bfa50bf237ea007d14ceaaa2275ad87cdcbfc2863dbfca940bde8d69f5f2bd0a90680d17e27c434f551af6a9f9294f3917a3
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
iwddhidiwddhidpid process 296 iwddhid 1356 iwddhid -
Deletes itself 1 IoCs
Processes:
pid process 1448 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f43e2e9f0b18e32408c3e4d628ea0f74.exeiwddhiddescription pid process target process PID 1184 set thread context of 1796 1184 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 296 set thread context of 1356 296 iwddhid iwddhid -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f43e2e9f0b18e32408c3e4d628ea0f74.exeiwddhiddescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f43e2e9f0b18e32408c3e4d628ea0f74.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f43e2e9f0b18e32408c3e4d628ea0f74.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f43e2e9f0b18e32408c3e4d628ea0f74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iwddhid Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iwddhid Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iwddhid -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f43e2e9f0b18e32408c3e4d628ea0f74.exepid process 1796 f43e2e9f0b18e32408c3e4d628ea0f74.exe 1796 f43e2e9f0b18e32408c3e4d628ea0f74.exe 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 1448 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1448 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f43e2e9f0b18e32408c3e4d628ea0f74.exepid process 1796 f43e2e9f0b18e32408c3e4d628ea0f74.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1448 1448 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1448 1448 -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
f43e2e9f0b18e32408c3e4d628ea0f74.exetaskeng.exeiwddhiddescription pid process target process PID 1184 wrote to memory of 1796 1184 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 1184 wrote to memory of 1796 1184 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 1184 wrote to memory of 1796 1184 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 1184 wrote to memory of 1796 1184 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 1184 wrote to memory of 1796 1184 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 1184 wrote to memory of 1796 1184 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 1184 wrote to memory of 1796 1184 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 1568 wrote to memory of 296 1568 taskeng.exe iwddhid PID 1568 wrote to memory of 296 1568 taskeng.exe iwddhid PID 1568 wrote to memory of 296 1568 taskeng.exe iwddhid PID 1568 wrote to memory of 296 1568 taskeng.exe iwddhid PID 296 wrote to memory of 1356 296 iwddhid iwddhid PID 296 wrote to memory of 1356 296 iwddhid iwddhid PID 296 wrote to memory of 1356 296 iwddhid iwddhid PID 296 wrote to memory of 1356 296 iwddhid iwddhid PID 296 wrote to memory of 1356 296 iwddhid iwddhid PID 296 wrote to memory of 1356 296 iwddhid iwddhid PID 296 wrote to memory of 1356 296 iwddhid iwddhid
Processes
-
C:\Users\Admin\AppData\Local\Temp\f43e2e9f0b18e32408c3e4d628ea0f74.exe"C:\Users\Admin\AppData\Local\Temp\f43e2e9f0b18e32408c3e4d628ea0f74.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f43e2e9f0b18e32408c3e4d628ea0f74.exe"C:\Users\Admin\AppData\Local\Temp\f43e2e9f0b18e32408c3e4d628ea0f74.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {F3E1BD88-4320-4B90-9193-029EE4535943} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\iwddhidC:\Users\Admin\AppData\Roaming\iwddhid2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\iwddhidC:\Users\Admin\AppData\Roaming\iwddhid3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\iwddhidMD5
f43e2e9f0b18e32408c3e4d628ea0f74
SHA190433a3494e734fa0a14441906302b60ded3f591
SHA25698ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8
SHA512fc149cdee4e540117d1413729a98bfa50bf237ea007d14ceaaa2275ad87cdcbfc2863dbfca940bde8d69f5f2bd0a90680d17e27c434f551af6a9f9294f3917a3
-
C:\Users\Admin\AppData\Roaming\iwddhidMD5
f43e2e9f0b18e32408c3e4d628ea0f74
SHA190433a3494e734fa0a14441906302b60ded3f591
SHA25698ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8
SHA512fc149cdee4e540117d1413729a98bfa50bf237ea007d14ceaaa2275ad87cdcbfc2863dbfca940bde8d69f5f2bd0a90680d17e27c434f551af6a9f9294f3917a3
-
C:\Users\Admin\AppData\Roaming\iwddhidMD5
f43e2e9f0b18e32408c3e4d628ea0f74
SHA190433a3494e734fa0a14441906302b60ded3f591
SHA25698ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8
SHA512fc149cdee4e540117d1413729a98bfa50bf237ea007d14ceaaa2275ad87cdcbfc2863dbfca940bde8d69f5f2bd0a90680d17e27c434f551af6a9f9294f3917a3
-
memory/296-63-0x00000000005F0000-0x000000000061D000-memory.dmpFilesize
180KB
-
memory/1184-55-0x0000000000510000-0x000000000053D000-memory.dmpFilesize
180KB
-
memory/1184-57-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1448-60-0x00000000026E0000-0x00000000026F6000-memory.dmpFilesize
88KB
-
memory/1796-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1796-58-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1796-59-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB