Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
01-12-2021 12:06
Static task
static1
Behavioral task
behavioral1
Sample
68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe
Resource
win10-en-20211104
General
-
Target
68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe
-
Size
329KB
-
MD5
a01cd71777793775949d174733418b59
-
SHA1
0e07d4367cb96b387d8c061bab965eb0bac71f3e
-
SHA256
68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe
-
SHA512
e17bdadce65fa1437b9877f5f348db1bba43c458b0167f3a0e908c5a52625fe4ce23f3c8716910bbb445b7e4627e3ccffc6375b7341e5dbef61f22484e43192f
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1352 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exedescription pid process target process PID 1424 set thread context of 1016 1424 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exepid process 1016 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe 1016 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1352 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exepid process 1016 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exedescription pid process target process PID 1424 wrote to memory of 1016 1424 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe PID 1424 wrote to memory of 1016 1424 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe PID 1424 wrote to memory of 1016 1424 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe PID 1424 wrote to memory of 1016 1424 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe PID 1424 wrote to memory of 1016 1424 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe PID 1424 wrote to memory of 1016 1424 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe PID 1424 wrote to memory of 1016 1424 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe"C:\Users\Admin\AppData\Local\Temp\68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe"C:\Users\Admin\AppData\Local\Temp\68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1016-57-0x0000000000402F47-mapping.dmp
-
memory/1016-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1016-58-0x0000000075D31000-0x0000000075D33000-memory.dmpFilesize
8KB
-
memory/1352-60-0x0000000001DD0000-0x0000000001DE6000-memory.dmpFilesize
88KB
-
memory/1424-55-0x0000000000608000-0x0000000000619000-memory.dmpFilesize
68KB
-
memory/1424-59-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB