Analysis
- max time kernel
172s - max time network
165s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
29/01/2022, 13:11
Static task
static1
Behavioral task
behavioral1
Sample
583707ca6b0c9206f66db2e02df0715d.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
583707ca6b0c9206f66db2e02df0715d.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target 583707ca6b0c9206f66db2e02df0715d.exe
- Size 318KB
- Sample220129-qeyfnsbfh2
- SHA256 04821c93b97a6b6ffdf80bcaf3e6491b6de39eff2caed87c19c1531a0c5c87d6
- MD5 583707ca6b0c9206f66db2e02df0715d
- SHA1 0021d125ebb8f4553f217c5904e9e17be4619795
- SHA512 71f6ce278ca8d8cef61676de7b021074ddc76745bc8d08ebfb2b3d9fbc1c32a4aac6db13df00ce06e083a2e55e521f5dca0190608191157b958885c2d4d6002d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-data-coin-11.com/
-
http://file-coin-host-12.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 3064 Process not Found - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3668 set thread context of 864 3668 583707ca6b0c9206f66db2e02df0715d.exe 68 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 583707ca6b0c9206f66db2e02df0715d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 583707ca6b0c9206f66db2e02df0715d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 583707ca6b0c9206f66db2e02df0715d.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 864 583707ca6b0c9206f66db2e02df0715d.exe 864 583707ca6b0c9206f66db2e02df0715d.exe 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3064 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 864 583707ca6b0c9206f66db2e02df0715d.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3668 wrote to memory of 864 3668 583707ca6b0c9206f66db2e02df0715d.exe 68 PID 3668 wrote to memory of 864 3668 583707ca6b0c9206f66db2e02df0715d.exe 68 PID 3668 wrote to memory of 864 3668 583707ca6b0c9206f66db2e02df0715d.exe 68 PID 3668 wrote to memory of 864 3668 583707ca6b0c9206f66db2e02df0715d.exe 68 PID 3668 wrote to memory of 864 3668 583707ca6b0c9206f66db2e02df0715d.exe 68 PID 3668 wrote to memory of 864 3668 583707ca6b0c9206f66db2e02df0715d.exe 68
Processes
-
C:\Users\Admin\AppData\Local\Temp\583707ca6b0c9206f66db2e02df0715d.exe"C:\Users\Admin\AppData\Local\Temp\583707ca6b0c9206f66db2e02df0715d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\583707ca6b0c9206f66db2e02df0715d.exe"C:\Users\Admin\AppData\Local\Temp\583707ca6b0c9206f66db2e02df0715d.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:864
-