Resubmissions
02-12-2021 21:17
211202-z5jvmsfah4 1002-12-2021 20:08
211202-ywq2xsbfcl 1002-12-2021 07:20
211202-h6ajxsffe5 1002-12-2021 07:16
211202-h35kwscegk 1028-11-2021 10:30
211128-mjst7shbfr 1028-11-2021 10:25
211128-mgbsxaccd5 10Analysis
-
max time kernel
603s -
max time network
600s -
platform
windows7_x64 -
resource
win7-ja-20211104 -
submitted
02-12-2021 07:20
Static task
static1
Behavioral task
behavioral1
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win7-ja-20211104
Behavioral task
behavioral2
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win7-en-20211014
Behavioral task
behavioral3
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win7-de-20211104
Behavioral task
behavioral4
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win11
Behavioral task
behavioral5
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win10-ja-20211014
Behavioral task
behavioral6
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win10-de-20211104
General
-
Target
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
-
Size
312KB
-
MD5
8c7681f265518e57648779adcfd5ec97
-
SHA1
581beb026b505ce66dea78ff17140a6e4c353acc
-
SHA256
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984
-
SHA512
65cf17a4b4b3e8b737aaf956accddeeb2ccb8ac73108ab486411944232d0b2cf4c66221aabac14124127daf1d86f5eaee54b73ee7bff95e348057cf0db0c472c
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
bututctbututctpid process 2032 bututct 1736 bututct -
Deletes itself 1 IoCs
Processes:
pid process 1276 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exebututctdescription pid process target process PID 524 set thread context of 1720 524 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 2032 set thread context of 1736 2032 bututct bututct -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exebututctdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bututct Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bututct Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bututct -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exepid process 1720 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe 1720 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1276 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exebututctpid process 1720 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe 1736 bututct -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1276 Token: SeShutdownPrivilege 1276 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1276 1276 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1276 1276 -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exetaskeng.exebututctdescription pid process target process PID 524 wrote to memory of 1720 524 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 524 wrote to memory of 1720 524 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 524 wrote to memory of 1720 524 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 524 wrote to memory of 1720 524 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 524 wrote to memory of 1720 524 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 524 wrote to memory of 1720 524 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 524 wrote to memory of 1720 524 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 1772 wrote to memory of 2032 1772 taskeng.exe bututct PID 1772 wrote to memory of 2032 1772 taskeng.exe bututct PID 1772 wrote to memory of 2032 1772 taskeng.exe bututct PID 1772 wrote to memory of 2032 1772 taskeng.exe bututct PID 2032 wrote to memory of 1736 2032 bututct bututct PID 2032 wrote to memory of 1736 2032 bututct bututct PID 2032 wrote to memory of 1736 2032 bututct bututct PID 2032 wrote to memory of 1736 2032 bututct bututct PID 2032 wrote to memory of 1736 2032 bututct bututct PID 2032 wrote to memory of 1736 2032 bututct bututct PID 2032 wrote to memory of 1736 2032 bututct bututct PID 1772 wrote to memory of 952 1772 taskeng.exe default-browser-agent.exe PID 1772 wrote to memory of 952 1772 taskeng.exe default-browser-agent.exe PID 1772 wrote to memory of 952 1772 taskeng.exe default-browser-agent.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe"C:\Users\Admin\AppData\Local\Temp\e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe"C:\Users\Admin\AppData\Local\Temp\e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {CEE26CFB-7AFF-4E63-9331-D00144E6EF3B} S-1-5-21-103686315-404690609-2047157615-1000:EDWYFHKN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\bututctC:\Users\Admin\AppData\Roaming\bututct2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\bututctC:\Users\Admin\AppData\Roaming\bututct3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Program Files\Mozilla Firefox\default-browser-agent.exe"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {60A103B3-5419-440F-A75D-3B8ADAB5E6BF} S-1-5-18:NT AUTHORITY\System:Service:1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\bututctMD5
8c7681f265518e57648779adcfd5ec97
SHA1581beb026b505ce66dea78ff17140a6e4c353acc
SHA256e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984
SHA51265cf17a4b4b3e8b737aaf956accddeeb2ccb8ac73108ab486411944232d0b2cf4c66221aabac14124127daf1d86f5eaee54b73ee7bff95e348057cf0db0c472c
-
C:\Users\Admin\AppData\Roaming\bututctMD5
8c7681f265518e57648779adcfd5ec97
SHA1581beb026b505ce66dea78ff17140a6e4c353acc
SHA256e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984
SHA51265cf17a4b4b3e8b737aaf956accddeeb2ccb8ac73108ab486411944232d0b2cf4c66221aabac14124127daf1d86f5eaee54b73ee7bff95e348057cf0db0c472c
-
C:\Users\Admin\AppData\Roaming\bututctMD5
8c7681f265518e57648779adcfd5ec97
SHA1581beb026b505ce66dea78ff17140a6e4c353acc
SHA256e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984
SHA51265cf17a4b4b3e8b737aaf956accddeeb2ccb8ac73108ab486411944232d0b2cf4c66221aabac14124127daf1d86f5eaee54b73ee7bff95e348057cf0db0c472c
-
memory/524-55-0x0000000003338000-0x0000000003349000-memory.dmpFilesize
68KB
-
memory/524-59-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/952-70-0x0000000000000000-mapping.dmp
-
memory/1276-69-0x00000000029A0000-0x00000000029B6000-memory.dmpFilesize
88KB
-
memory/1276-60-0x0000000002AD0000-0x0000000002AE6000-memory.dmpFilesize
88KB
-
memory/1720-58-0x00000000766B1000-0x00000000766B3000-memory.dmpFilesize
8KB
-
memory/1720-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1720-57-0x0000000000402F47-mapping.dmp
-
memory/1736-66-0x0000000000402F47-mapping.dmp
-
memory/2032-64-0x00000000033E8000-0x00000000033F9000-memory.dmpFilesize
68KB
-
memory/2032-62-0x0000000000000000-mapping.dmp