Analysis
- max time kernel
156s - max time network
166s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
31/01/2022, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
ca24a6bae05d6a928d1516f524a1c9f7.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ca24a6bae05d6a928d1516f524a1c9f7.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target ca24a6bae05d6a928d1516f524a1c9f7.exe
- Size 233KB
- Sample220131-jmjtxsggfj
- SHA256 c4720963dc79b14472c8ba7ec4c7863e288cce5632c895434f1d4ecc2de01bee
- MD5 ca24a6bae05d6a928d1516f524a1c9f7
- SHA1 821aae50029ad2dc340d10f1f70fe4d98e7fc776
- SHA512 0024b800943180090caecd146f81410af5c0c397b263338bb82dc3d05817549ff57aeea2018f1118e5a8a60d469481532085de159581cd1d4242d87119a9b150
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-data-coin-11.com/
-
http://file-coin-host-12.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 2 IoCs
pid Process 2528 gvavsda 796 gvavsda - Deletes itself 1 IoCs
pid Process 3040 Process not Found - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2632 set thread context of 2876 2632 ca24a6bae05d6a928d1516f524a1c9f7.exe 68 PID 2528 set thread context of 796 2528 gvavsda 72 - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ca24a6bae05d6a928d1516f524a1c9f7.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ca24a6bae05d6a928d1516f524a1c9f7.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ca24a6bae05d6a928d1516f524a1c9f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gvavsda Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gvavsda Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gvavsda - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2876 ca24a6bae05d6a928d1516f524a1c9f7.exe 2876 ca24a6bae05d6a928d1516f524a1c9f7.exe 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3040 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2876 ca24a6bae05d6a928d1516f524a1c9f7.exe 796 gvavsda - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2876 2632 ca24a6bae05d6a928d1516f524a1c9f7.exe 68 PID 2632 wrote to memory of 2876 2632 ca24a6bae05d6a928d1516f524a1c9f7.exe 68 PID 2632 wrote to memory of 2876 2632 ca24a6bae05d6a928d1516f524a1c9f7.exe 68 PID 2632 wrote to memory of 2876 2632 ca24a6bae05d6a928d1516f524a1c9f7.exe 68 PID 2632 wrote to memory of 2876 2632 ca24a6bae05d6a928d1516f524a1c9f7.exe 68 PID 2632 wrote to memory of 2876 2632 ca24a6bae05d6a928d1516f524a1c9f7.exe 68 PID 2528 wrote to memory of 796 2528 gvavsda 72 PID 2528 wrote to memory of 796 2528 gvavsda 72 PID 2528 wrote to memory of 796 2528 gvavsda 72 PID 2528 wrote to memory of 796 2528 gvavsda 72 PID 2528 wrote to memory of 796 2528 gvavsda 72 PID 2528 wrote to memory of 796 2528 gvavsda 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca24a6bae05d6a928d1516f524a1c9f7.exe"C:\Users\Admin\AppData\Local\Temp\ca24a6bae05d6a928d1516f524a1c9f7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\ca24a6bae05d6a928d1516f524a1c9f7.exe"C:\Users\Admin\AppData\Local\Temp\ca24a6bae05d6a928d1516f524a1c9f7.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2876
-
-
C:\Users\Admin\AppData\Roaming\gvavsdaC:\Users\Admin\AppData\Roaming\gvavsda1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Roaming\gvavsdaC:\Users\Admin\AppData\Roaming\gvavsda2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:796
-