Overview

overview

10

Static

static

1

39db8f99f4...e4.exe

windows7_x64

10

39db8f99f4...e4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    39db8f99f438c93f7c1884efd0174499cae4ed0f972ee35bce41d0aa02a485e4

  • Size

    2.4MB

  • Sample

    220625-jqlspaebd4

  • MD5

    3d7c637e0e04b7f9e10414c227a2f102

  • SHA1

    08e66ae0af9b16775fe9b614e2ed864934b74b2b

  • SHA256

    39db8f99f438c93f7c1884efd0174499cae4ed0f972ee35bce41d0aa02a485e4

  • SHA512

    6e74ddf4e7e16e00bc8e60bf09ebbd9a0d29475c2cf20dafd8c7d5a82b1b3cb0083667a8b0de015f0eb88e8a46fced28856a315a7053a725b4dea9b528665373

Score
10/10
smokeloaderxmrigbackdoorminertrojanvmprotect

Malware Config

Extracted

Family

smokeloader

Version

2018

C2

http://converadm.bit/

rc4.i32
rc4.i32

Targets

    • Target

      39db8f99f438c93f7c1884efd0174499cae4ed0f972ee35bce41d0aa02a485e4

    • Size

      2.4MB

    • MD5

      3d7c637e0e04b7f9e10414c227a2f102

    • SHA1

      08e66ae0af9b16775fe9b614e2ed864934b74b2b

    • SHA256

      39db8f99f438c93f7c1884efd0174499cae4ed0f972ee35bce41d0aa02a485e4

    • SHA512

      6e74ddf4e7e16e00bc8e60bf09ebbd9a0d29475c2cf20dafd8c7d5a82b1b3cb0083667a8b0de015f0eb88e8a46fced28856a315a7053a725b4dea9b528665373

    Score
    10/10
    smokeloaderxmrigbackdoorminertrojanvmprotect

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner Payload

      miner

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks