Analysis
- max time kernel
155s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
01/03/2022, 08:26
Static task
static1
Behavioral task
behavioral1
Sample
5797927d3ea2d6ebaf117313c3101ead.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5797927d3ea2d6ebaf117313c3101ead.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target 5797927d3ea2d6ebaf117313c3101ead.exe
- Size 326KB
- Sample220301-kbypdahca4
- SHA256 2c52014ce36c8ec851ec96f8a4aaf656c80b250c1f66aca1e685ca7b1be0c4bc
- MD5 5797927d3ea2d6ebaf117313c3101ead
- SHA1 16613db865d587aa73d25d6fc8b8ffbc434acaff
- SHA512 98bb706f507b7048058a381636f46cf33308eaec0e21422cf6c71419b686dd0e12b69207465a6df4ae4bc7dc2fa866874399e1eae8dd92b626d54fd4e064aa5b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-data-coin-11.com/
-
http://file-coin-host-12.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3100 set thread context of 4048 3100 5797927d3ea2d6ebaf117313c3101ead.exe 60 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5797927d3ea2d6ebaf117313c3101ead.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5797927d3ea2d6ebaf117313c3101ead.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5797927d3ea2d6ebaf117313c3101ead.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4048 5797927d3ea2d6ebaf117313c3101ead.exe 4048 5797927d3ea2d6ebaf117313c3101ead.exe 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found 2308 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2308 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4048 5797927d3ea2d6ebaf117313c3101ead.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2308 Process not Found Token: SeCreatePagefilePrivilege 2308 Process not Found - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3100 wrote to memory of 4048 3100 5797927d3ea2d6ebaf117313c3101ead.exe 60 PID 3100 wrote to memory of 4048 3100 5797927d3ea2d6ebaf117313c3101ead.exe 60 PID 3100 wrote to memory of 4048 3100 5797927d3ea2d6ebaf117313c3101ead.exe 60 PID 3100 wrote to memory of 4048 3100 5797927d3ea2d6ebaf117313c3101ead.exe 60 PID 3100 wrote to memory of 4048 3100 5797927d3ea2d6ebaf117313c3101ead.exe 60 PID 3100 wrote to memory of 4048 3100 5797927d3ea2d6ebaf117313c3101ead.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\5797927d3ea2d6ebaf117313c3101ead.exe"C:\Users\Admin\AppData\Local\Temp\5797927d3ea2d6ebaf117313c3101ead.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\5797927d3ea2d6ebaf117313c3101ead.exe"C:\Users\Admin\AppData\Local\Temp\5797927d3ea2d6ebaf117313c3101ead.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4048
-