Analysis
- max time kernel
4294238s - max time network
150s - platform
windows7_x64 - resource
win7-20220223-en - submitted
09/03/2022, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
d9a418a4a8e02683c79daeaadd464595.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d9a418a4a8e02683c79daeaadd464595.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target d9a418a4a8e02683c79daeaadd464595.exe
- Size 287KB
- Sample220309-e2jegsddf5
- SHA256 954fdefd2dd5cf44876783f51cf35edef3fb790ed3ba777c1bfafb13680a1ccc
- MD5 d9a418a4a8e02683c79daeaadd464595
- SHA1 9f53b07cd8488dd9a6fcd73945b1ba2cd9e7f254
- SHA512 51e9163643ba1a36f808c64f9fc07eb79f289fac444817e4cc1d11b79153b6e78d73ecbf711caace0f0cf119c9381cef0ac6dc9febd061ef5329eaca205838b6
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-data-coin-11.com/
-
http://file-coin-host-12.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1220 Process not Found - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1504 set thread context of 660 1504 d9a418a4a8e02683c79daeaadd464595.exe 29 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d9a418a4a8e02683c79daeaadd464595.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d9a418a4a8e02683c79daeaadd464595.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d9a418a4a8e02683c79daeaadd464595.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 660 d9a418a4a8e02683c79daeaadd464595.exe 660 d9a418a4a8e02683c79daeaadd464595.exe 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1220 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 660 d9a418a4a8e02683c79daeaadd464595.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1220 Process not Found 1220 Process not Found - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1220 Process not Found 1220 Process not Found - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1504 wrote to memory of 660 1504 d9a418a4a8e02683c79daeaadd464595.exe 29 PID 1504 wrote to memory of 660 1504 d9a418a4a8e02683c79daeaadd464595.exe 29 PID 1504 wrote to memory of 660 1504 d9a418a4a8e02683c79daeaadd464595.exe 29 PID 1504 wrote to memory of 660 1504 d9a418a4a8e02683c79daeaadd464595.exe 29 PID 1504 wrote to memory of 660 1504 d9a418a4a8e02683c79daeaadd464595.exe 29 PID 1504 wrote to memory of 660 1504 d9a418a4a8e02683c79daeaadd464595.exe 29 PID 1504 wrote to memory of 660 1504 d9a418a4a8e02683c79daeaadd464595.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9a418a4a8e02683c79daeaadd464595.exe"C:\Users\Admin\AppData\Local\Temp\d9a418a4a8e02683c79daeaadd464595.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\d9a418a4a8e02683c79daeaadd464595.exe"C:\Users\Admin\AppData\Local\Temp\d9a418a4a8e02683c79daeaadd464595.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:660
-