Resubmissions
02-12-2021 21:17
211202-z5jvmsfah4 1002-12-2021 20:08
211202-ywq2xsbfcl 1002-12-2021 07:20
211202-h6ajxsffe5 1002-12-2021 07:16
211202-h35kwscegk 1028-11-2021 10:30
211128-mjst7shbfr 1028-11-2021 10:25
211128-mgbsxaccd5 10Analysis
-
max time kernel
603s -
max time network
600s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
02-12-2021 20:08
Static task
static1
Behavioral task
behavioral1
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win7-en-20211104
Behavioral task
behavioral4
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win10-en-20211104
Behavioral task
behavioral5
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win7-en-20211014
Behavioral task
behavioral6
Sample
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
Resource
win10-en-20211104
General
-
Target
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe
-
Size
312KB
-
MD5
8c7681f265518e57648779adcfd5ec97
-
SHA1
581beb026b505ce66dea78ff17140a6e4c353acc
-
SHA256
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984
-
SHA512
65cf17a4b4b3e8b737aaf956accddeeb2ccb8ac73108ab486411944232d0b2cf4c66221aabac14124127daf1d86f5eaee54b73ee7bff95e348057cf0db0c472c
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
susactcsusactcpid process 1864 susactc 1036 susactc -
Deletes itself 1 IoCs
Processes:
pid process 1212 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exesusactcdescription pid process target process PID 1724 set thread context of 472 1724 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 1864 set thread context of 1036 1864 susactc susactc -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
susactce94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI susactc Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI susactc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI susactc -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exepid process 472 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe 472 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1212 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exesusactcpid process 472 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe 1036 susactc -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1212 Token: SeShutdownPrivilege 1212 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1212 1212 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1212 1212 -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exetaskeng.exesusactcdescription pid process target process PID 1724 wrote to memory of 472 1724 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 1724 wrote to memory of 472 1724 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 1724 wrote to memory of 472 1724 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 1724 wrote to memory of 472 1724 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 1724 wrote to memory of 472 1724 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 1724 wrote to memory of 472 1724 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 1724 wrote to memory of 472 1724 e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe PID 896 wrote to memory of 1864 896 taskeng.exe susactc PID 896 wrote to memory of 1864 896 taskeng.exe susactc PID 896 wrote to memory of 1864 896 taskeng.exe susactc PID 896 wrote to memory of 1864 896 taskeng.exe susactc PID 1864 wrote to memory of 1036 1864 susactc susactc PID 1864 wrote to memory of 1036 1864 susactc susactc PID 1864 wrote to memory of 1036 1864 susactc susactc PID 1864 wrote to memory of 1036 1864 susactc susactc PID 1864 wrote to memory of 1036 1864 susactc susactc PID 1864 wrote to memory of 1036 1864 susactc susactc PID 1864 wrote to memory of 1036 1864 susactc susactc
Processes
-
C:\Users\Admin\AppData\Local\Temp\e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe"C:\Users\Admin\AppData\Local\Temp\e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe"C:\Users\Admin\AppData\Local\Temp\e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {4A80A437-09DC-4EF9-A2C2-2E8A816E332B} S-1-5-21-103686315-404690609-2047157615-1000:EDWYFHKN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\susactcC:\Users\Admin\AppData\Roaming\susactc2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\susactcC:\Users\Admin\AppData\Roaming\susactc3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\susactcMD5
8c7681f265518e57648779adcfd5ec97
SHA1581beb026b505ce66dea78ff17140a6e4c353acc
SHA256e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984
SHA51265cf17a4b4b3e8b737aaf956accddeeb2ccb8ac73108ab486411944232d0b2cf4c66221aabac14124127daf1d86f5eaee54b73ee7bff95e348057cf0db0c472c
-
C:\Users\Admin\AppData\Roaming\susactcMD5
8c7681f265518e57648779adcfd5ec97
SHA1581beb026b505ce66dea78ff17140a6e4c353acc
SHA256e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984
SHA51265cf17a4b4b3e8b737aaf956accddeeb2ccb8ac73108ab486411944232d0b2cf4c66221aabac14124127daf1d86f5eaee54b73ee7bff95e348057cf0db0c472c
-
C:\Users\Admin\AppData\Roaming\susactcMD5
8c7681f265518e57648779adcfd5ec97
SHA1581beb026b505ce66dea78ff17140a6e4c353acc
SHA256e94ed1fcc1cf44012a075bf53b076f75ab6565ac76fb18e0b32681cfc986f984
SHA51265cf17a4b4b3e8b737aaf956accddeeb2ccb8ac73108ab486411944232d0b2cf4c66221aabac14124127daf1d86f5eaee54b73ee7bff95e348057cf0db0c472c
-
memory/472-58-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/472-57-0x0000000000402F47-mapping.dmp
-
memory/472-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1036-66-0x0000000000402F47-mapping.dmp
-
memory/1212-60-0x0000000002A20000-0x0000000002A36000-memory.dmpFilesize
88KB
-
memory/1212-69-0x0000000002A50000-0x0000000002A66000-memory.dmpFilesize
88KB
-
memory/1724-59-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/1724-55-0x00000000033C8000-0x00000000033D9000-memory.dmpFilesize
68KB
-
memory/1864-62-0x0000000000000000-mapping.dmp
-
memory/1864-64-0x00000000032D8000-0x00000000032E9000-memory.dmpFilesize
68KB