Analysis
- max time kernel
168s - max time network
176s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
31/01/2022, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
851276c6c899eac84e4e87e338499abb.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
851276c6c899eac84e4e87e338499abb.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target 851276c6c899eac84e4e87e338499abb.exe
- Size 260KB
- Sample220131-japjmsgfhm
- SHA256 03db70c0bf951c67a9a85207faa39c6c129a8bb667dcf9cbbb472405fb77f3dc
- MD5 851276c6c899eac84e4e87e338499abb
- SHA1 9860be18be56958bbde2c6953987eb248c433eba
- SHA512 10cd2892ca9c7c2533078f88e97338ba0ead9333b8fae706ffb2675ae3aeaa57859295ee859e58d5be8ee07dddd676c26c9728e8d96383cb27660393afc6f0ce
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-data-coin-11.com/
-
http://file-coin-host-12.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 2 IoCs
pid Process 1304 tceeftg 2888 tceeftg - Deletes itself 1 IoCs
pid Process 3016 Process not Found - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2768 set thread context of 2128 2768 851276c6c899eac84e4e87e338499abb.exe 68 PID 1304 set thread context of 2888 1304 tceeftg 72 - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 851276c6c899eac84e4e87e338499abb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tceeftg Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tceeftg Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tceeftg Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 851276c6c899eac84e4e87e338499abb.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 851276c6c899eac84e4e87e338499abb.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2128 851276c6c899eac84e4e87e338499abb.exe 2128 851276c6c899eac84e4e87e338499abb.exe 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3016 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2128 851276c6c899eac84e4e87e338499abb.exe 2888 tceeftg - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3016 Process not Found Token: SeCreatePagefilePrivilege 3016 Process not Found - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2128 2768 851276c6c899eac84e4e87e338499abb.exe 68 PID 2768 wrote to memory of 2128 2768 851276c6c899eac84e4e87e338499abb.exe 68 PID 2768 wrote to memory of 2128 2768 851276c6c899eac84e4e87e338499abb.exe 68 PID 2768 wrote to memory of 2128 2768 851276c6c899eac84e4e87e338499abb.exe 68 PID 2768 wrote to memory of 2128 2768 851276c6c899eac84e4e87e338499abb.exe 68 PID 2768 wrote to memory of 2128 2768 851276c6c899eac84e4e87e338499abb.exe 68 PID 1304 wrote to memory of 2888 1304 tceeftg 72 PID 1304 wrote to memory of 2888 1304 tceeftg 72 PID 1304 wrote to memory of 2888 1304 tceeftg 72 PID 1304 wrote to memory of 2888 1304 tceeftg 72 PID 1304 wrote to memory of 2888 1304 tceeftg 72 PID 1304 wrote to memory of 2888 1304 tceeftg 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\851276c6c899eac84e4e87e338499abb.exe"C:\Users\Admin\AppData\Local\Temp\851276c6c899eac84e4e87e338499abb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\851276c6c899eac84e4e87e338499abb.exe"C:\Users\Admin\AppData\Local\Temp\851276c6c899eac84e4e87e338499abb.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2128
-
-
C:\Users\Admin\AppData\Roaming\tceeftgC:\Users\Admin\AppData\Roaming\tceeftg1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Roaming\tceeftgC:\Users\Admin\AppData\Roaming\tceeftg2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2888
-