Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
02-12-2021 15:55
Static task
static1
Behavioral task
behavioral1
Sample
1f45148595dd5c401bc8c0d150a74cbc.exe
Resource
win7-en-20211104
General
-
Target
1f45148595dd5c401bc8c0d150a74cbc.exe
-
Size
244KB
-
MD5
1f45148595dd5c401bc8c0d150a74cbc
-
SHA1
a53b57b67512d4151c4a5d06dac512643da21be7
-
SHA256
ea2a2d0b594f527f391abdf595d5f93424d9121dc292ff458362bff765bff2cd
-
SHA512
c810db3b5dfa70f14425fb411c3bd35ad6c23d3fe3bcf03b604bf51033bf22aecba6bc61bd0ade06228b8b4c82d0a595e105a3ff3a3c2399a741c21c4c14906a
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1300 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1f45148595dd5c401bc8c0d150a74cbc.exedescription pid process target process PID 1072 set thread context of 336 1072 1f45148595dd5c401bc8c0d150a74cbc.exe 1f45148595dd5c401bc8c0d150a74cbc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
1f45148595dd5c401bc8c0d150a74cbc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1f45148595dd5c401bc8c0d150a74cbc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1f45148595dd5c401bc8c0d150a74cbc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1f45148595dd5c401bc8c0d150a74cbc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1f45148595dd5c401bc8c0d150a74cbc.exepid process 336 1f45148595dd5c401bc8c0d150a74cbc.exe 336 1f45148595dd5c401bc8c0d150a74cbc.exe 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1300 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
1f45148595dd5c401bc8c0d150a74cbc.exepid process 336 1f45148595dd5c401bc8c0d150a74cbc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1300 1300 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1300 1300 -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
1f45148595dd5c401bc8c0d150a74cbc.exedescription pid process target process PID 1072 wrote to memory of 336 1072 1f45148595dd5c401bc8c0d150a74cbc.exe 1f45148595dd5c401bc8c0d150a74cbc.exe PID 1072 wrote to memory of 336 1072 1f45148595dd5c401bc8c0d150a74cbc.exe 1f45148595dd5c401bc8c0d150a74cbc.exe PID 1072 wrote to memory of 336 1072 1f45148595dd5c401bc8c0d150a74cbc.exe 1f45148595dd5c401bc8c0d150a74cbc.exe PID 1072 wrote to memory of 336 1072 1f45148595dd5c401bc8c0d150a74cbc.exe 1f45148595dd5c401bc8c0d150a74cbc.exe PID 1072 wrote to memory of 336 1072 1f45148595dd5c401bc8c0d150a74cbc.exe 1f45148595dd5c401bc8c0d150a74cbc.exe PID 1072 wrote to memory of 336 1072 1f45148595dd5c401bc8c0d150a74cbc.exe 1f45148595dd5c401bc8c0d150a74cbc.exe PID 1072 wrote to memory of 336 1072 1f45148595dd5c401bc8c0d150a74cbc.exe 1f45148595dd5c401bc8c0d150a74cbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f45148595dd5c401bc8c0d150a74cbc.exe"C:\Users\Admin\AppData\Local\Temp\1f45148595dd5c401bc8c0d150a74cbc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1f45148595dd5c401bc8c0d150a74cbc.exe"C:\Users\Admin\AppData\Local\Temp\1f45148595dd5c401bc8c0d150a74cbc.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/336-55-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/336-56-0x0000000000402F47-mapping.dmp
-
memory/336-57-0x0000000075881000-0x0000000075883000-memory.dmpFilesize
8KB
-
memory/1072-58-0x00000000001B0000-0x00000000001B9000-memory.dmpFilesize
36KB
-
memory/1072-59-0x00000000001C0000-0x00000000001C9000-memory.dmpFilesize
36KB
-
memory/1300-60-0x0000000002180000-0x0000000002196000-memory.dmpFilesize
88KB