Analysis
- max time kernel
167s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
09/03/2022, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
d9a418a4a8e02683c79daeaadd464595.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d9a418a4a8e02683c79daeaadd464595.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target d9a418a4a8e02683c79daeaadd464595.exe
- Size 287KB
- Sample220309-e2jegsddf5
- SHA256 954fdefd2dd5cf44876783f51cf35edef3fb790ed3ba777c1bfafb13680a1ccc
- MD5 d9a418a4a8e02683c79daeaadd464595
- SHA1 9f53b07cd8488dd9a6fcd73945b1ba2cd9e7f254
- SHA512 51e9163643ba1a36f808c64f9fc07eb79f289fac444817e4cc1d11b79153b6e78d73ecbf711caace0f0cf119c9381cef0ac6dc9febd061ef5329eaca205838b6
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-data-coin-11.com/
-
http://file-coin-host-12.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2296 set thread context of 1940 2296 d9a418a4a8e02683c79daeaadd464595.exe 80 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d9a418a4a8e02683c79daeaadd464595.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d9a418a4a8e02683c79daeaadd464595.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d9a418a4a8e02683c79daeaadd464595.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1940 d9a418a4a8e02683c79daeaadd464595.exe 1940 d9a418a4a8e02683c79daeaadd464595.exe 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found 2436 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2436 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1940 d9a418a4a8e02683c79daeaadd464595.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2436 Process not Found Token: SeCreatePagefilePrivilege 2436 Process not Found - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2296 wrote to memory of 1940 2296 d9a418a4a8e02683c79daeaadd464595.exe 80 PID 2296 wrote to memory of 1940 2296 d9a418a4a8e02683c79daeaadd464595.exe 80 PID 2296 wrote to memory of 1940 2296 d9a418a4a8e02683c79daeaadd464595.exe 80 PID 2296 wrote to memory of 1940 2296 d9a418a4a8e02683c79daeaadd464595.exe 80 PID 2296 wrote to memory of 1940 2296 d9a418a4a8e02683c79daeaadd464595.exe 80 PID 2296 wrote to memory of 1940 2296 d9a418a4a8e02683c79daeaadd464595.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9a418a4a8e02683c79daeaadd464595.exe"C:\Users\Admin\AppData\Local\Temp\d9a418a4a8e02683c79daeaadd464595.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\d9a418a4a8e02683c79daeaadd464595.exe"C:\Users\Admin\AppData\Local\Temp\d9a418a4a8e02683c79daeaadd464595.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1940
-