Analysis
- max time kernel
152s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
28/03/2022, 08:17
Static task
static1
Behavioral task
behavioral1
Sample
19c980ee3eaf8d9704e7e6f630934082.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
19c980ee3eaf8d9704e7e6f630934082.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 19c980ee3eaf8d9704e7e6f630934082.exe
- Size 272KB
- Sample220328-j6pvaaddar
- SHA256 d941de99b4f1c476c39a4d5679f945710161d76e3920dbca3000b7fa83870d0e
- MD5 19c980ee3eaf8d9704e7e6f630934082
- SHA1 8bb6735ff8bcd3e5f2111912c0964ca5ac26c265
- SHA512 ee17e64c46122d50afb618a6cd540190cf23670a7125bc188a261e537401a97cf4aeb4e4d538b55171010bada5e9b94bda2995172498383fe34028ea4b8223c2
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-data-coin-11.com/
-
http://file-coin-host-12.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 2 IoCs
pid Process 1824 vhwejis 2992 vhwejis - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1012 set thread context of 1476 1012 19c980ee3eaf8d9704e7e6f630934082.exe 81 PID 1824 set thread context of 2992 1824 vhwejis 91 - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 19c980ee3eaf8d9704e7e6f630934082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vhwejis Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vhwejis Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vhwejis Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 19c980ee3eaf8d9704e7e6f630934082.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 19c980ee3eaf8d9704e7e6f630934082.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1476 19c980ee3eaf8d9704e7e6f630934082.exe 1476 19c980ee3eaf8d9704e7e6f630934082.exe 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found 2416 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2416 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1476 19c980ee3eaf8d9704e7e6f630934082.exe 2992 vhwejis - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2416 Process not Found Token: SeCreatePagefilePrivilege 2416 Process not Found - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1012 wrote to memory of 1476 1012 19c980ee3eaf8d9704e7e6f630934082.exe 81 PID 1012 wrote to memory of 1476 1012 19c980ee3eaf8d9704e7e6f630934082.exe 81 PID 1012 wrote to memory of 1476 1012 19c980ee3eaf8d9704e7e6f630934082.exe 81 PID 1012 wrote to memory of 1476 1012 19c980ee3eaf8d9704e7e6f630934082.exe 81 PID 1012 wrote to memory of 1476 1012 19c980ee3eaf8d9704e7e6f630934082.exe 81 PID 1012 wrote to memory of 1476 1012 19c980ee3eaf8d9704e7e6f630934082.exe 81 PID 1824 wrote to memory of 2992 1824 vhwejis 91 PID 1824 wrote to memory of 2992 1824 vhwejis 91 PID 1824 wrote to memory of 2992 1824 vhwejis 91 PID 1824 wrote to memory of 2992 1824 vhwejis 91 PID 1824 wrote to memory of 2992 1824 vhwejis 91 PID 1824 wrote to memory of 2992 1824 vhwejis 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\19c980ee3eaf8d9704e7e6f630934082.exe"C:\Users\Admin\AppData\Local\Temp\19c980ee3eaf8d9704e7e6f630934082.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\19c980ee3eaf8d9704e7e6f630934082.exe"C:\Users\Admin\AppData\Local\Temp\19c980ee3eaf8d9704e7e6f630934082.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1476
-
-
C:\Users\Admin\AppData\Roaming\vhwejisC:\Users\Admin\AppData\Roaming\vhwejis1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Roaming\vhwejisC:\Users\Admin\AppData\Roaming\vhwejis2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2992
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\vhwejis
- Size 272KB
- SHA256 d941de99b4f1c476c39a4d5679f945710161d76e3920dbca3000b7fa83870d0e
- MD5 19c980ee3eaf8d9704e7e6f630934082
- SHA1 8bb6735ff8bcd3e5f2111912c0964ca5ac26c265
- SHA512 ee17e64c46122d50afb618a6cd540190cf23670a7125bc188a261e537401a97cf4aeb4e4d538b55171010bada5e9b94bda2995172498383fe34028ea4b8223c2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\vhwejis
- Size 272KB
- SHA256 d941de99b4f1c476c39a4d5679f945710161d76e3920dbca3000b7fa83870d0e
- MD5 19c980ee3eaf8d9704e7e6f630934082
- SHA1 8bb6735ff8bcd3e5f2111912c0964ca5ac26c265
- SHA512 ee17e64c46122d50afb618a6cd540190cf23670a7125bc188a261e537401a97cf4aeb4e4d538b55171010bada5e9b94bda2995172498383fe34028ea4b8223c2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\vhwejis
- Size 272KB
- SHA256 d941de99b4f1c476c39a4d5679f945710161d76e3920dbca3000b7fa83870d0e
- MD5 19c980ee3eaf8d9704e7e6f630934082
- SHA1 8bb6735ff8bcd3e5f2111912c0964ca5ac26c265
- SHA512 ee17e64c46122d50afb618a6cd540190cf23670a7125bc188a261e537401a97cf4aeb4e4d538b55171010bada5e9b94bda2995172498383fe34028ea4b8223c2
- MD5 SHA1 SHA512