Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
07-12-2021 10:36
Static task
static1
Behavioral task
behavioral1
Sample
a6fe288d87226f784eeaca4a4fbe8c06.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
a6fe288d87226f784eeaca4a4fbe8c06.exe
Resource
win10-en-20211014
General
-
Target
a6fe288d87226f784eeaca4a4fbe8c06.exe
-
Size
320KB
-
MD5
a6fe288d87226f784eeaca4a4fbe8c06
-
SHA1
3c83d0eea596f0028f9279fa17e444dc33fa250f
-
SHA256
1b4e1e9586e86d4728bb9396fe757b258ca6d5f36f8b277e7a5aa19c35c88451
-
SHA512
a505e3d7ff6a6e107819026cbd28183d720a05a5f50601baf0f633c05004774f4a7f58df584384c7c0d503ff9fcd1726d5a0ae4b75ef0092eb1d4cbfddc495ef
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
92CD.exe92CD.exepid process 1764 92CD.exe 824 92CD.exe -
Deletes itself 1 IoCs
Processes:
pid process 1212 -
Loads dropped DLL 1 IoCs
Processes:
92CD.exepid process 1764 92CD.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a6fe288d87226f784eeaca4a4fbe8c06.exe92CD.exedescription pid process target process PID 1992 set thread context of 772 1992 a6fe288d87226f784eeaca4a4fbe8c06.exe a6fe288d87226f784eeaca4a4fbe8c06.exe PID 1764 set thread context of 824 1764 92CD.exe 92CD.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a6fe288d87226f784eeaca4a4fbe8c06.exe92CD.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a6fe288d87226f784eeaca4a4fbe8c06.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a6fe288d87226f784eeaca4a4fbe8c06.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a6fe288d87226f784eeaca4a4fbe8c06.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92CD.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92CD.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92CD.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a6fe288d87226f784eeaca4a4fbe8c06.exepid process 772 a6fe288d87226f784eeaca4a4fbe8c06.exe 772 a6fe288d87226f784eeaca4a4fbe8c06.exe 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1212 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
a6fe288d87226f784eeaca4a4fbe8c06.exe92CD.exepid process 772 a6fe288d87226f784eeaca4a4fbe8c06.exe 824 92CD.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1212 1212 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1212 1212 -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
a6fe288d87226f784eeaca4a4fbe8c06.exe92CD.exedescription pid process target process PID 1992 wrote to memory of 772 1992 a6fe288d87226f784eeaca4a4fbe8c06.exe a6fe288d87226f784eeaca4a4fbe8c06.exe PID 1992 wrote to memory of 772 1992 a6fe288d87226f784eeaca4a4fbe8c06.exe a6fe288d87226f784eeaca4a4fbe8c06.exe PID 1992 wrote to memory of 772 1992 a6fe288d87226f784eeaca4a4fbe8c06.exe a6fe288d87226f784eeaca4a4fbe8c06.exe PID 1992 wrote to memory of 772 1992 a6fe288d87226f784eeaca4a4fbe8c06.exe a6fe288d87226f784eeaca4a4fbe8c06.exe PID 1992 wrote to memory of 772 1992 a6fe288d87226f784eeaca4a4fbe8c06.exe a6fe288d87226f784eeaca4a4fbe8c06.exe PID 1992 wrote to memory of 772 1992 a6fe288d87226f784eeaca4a4fbe8c06.exe a6fe288d87226f784eeaca4a4fbe8c06.exe PID 1992 wrote to memory of 772 1992 a6fe288d87226f784eeaca4a4fbe8c06.exe a6fe288d87226f784eeaca4a4fbe8c06.exe PID 1212 wrote to memory of 1764 1212 92CD.exe PID 1212 wrote to memory of 1764 1212 92CD.exe PID 1212 wrote to memory of 1764 1212 92CD.exe PID 1212 wrote to memory of 1764 1212 92CD.exe PID 1764 wrote to memory of 824 1764 92CD.exe 92CD.exe PID 1764 wrote to memory of 824 1764 92CD.exe 92CD.exe PID 1764 wrote to memory of 824 1764 92CD.exe 92CD.exe PID 1764 wrote to memory of 824 1764 92CD.exe 92CD.exe PID 1764 wrote to memory of 824 1764 92CD.exe 92CD.exe PID 1764 wrote to memory of 824 1764 92CD.exe 92CD.exe PID 1764 wrote to memory of 824 1764 92CD.exe 92CD.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6fe288d87226f784eeaca4a4fbe8c06.exe"C:\Users\Admin\AppData\Local\Temp\a6fe288d87226f784eeaca4a4fbe8c06.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a6fe288d87226f784eeaca4a4fbe8c06.exe"C:\Users\Admin\AppData\Local\Temp\a6fe288d87226f784eeaca4a4fbe8c06.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\92CD.exeC:\Users\Admin\AppData\Local\Temp\92CD.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\92CD.exeC:\Users\Admin\AppData\Local\Temp\92CD.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\92CD.exeMD5
7f98e524346266f8018ba22eaa6113d1
SHA1e778147c2e2c434ba997e96cd4d76dd4cb84ca42
SHA256d6b47354dff2693d279b357d0901496908922679207ebef447e78160cd45bdf3
SHA5121b1615a9753f8eafdafd9381265ef78e2e7bef3e1f26553ceb8d9c734a0cfbb83eb33ef488d927c53093dfd644ab8ce11203aa2aa69a0384cdafcedff9df4bcd
-
C:\Users\Admin\AppData\Local\Temp\92CD.exeMD5
7f98e524346266f8018ba22eaa6113d1
SHA1e778147c2e2c434ba997e96cd4d76dd4cb84ca42
SHA256d6b47354dff2693d279b357d0901496908922679207ebef447e78160cd45bdf3
SHA5121b1615a9753f8eafdafd9381265ef78e2e7bef3e1f26553ceb8d9c734a0cfbb83eb33ef488d927c53093dfd644ab8ce11203aa2aa69a0384cdafcedff9df4bcd
-
C:\Users\Admin\AppData\Local\Temp\92CD.exeMD5
7f98e524346266f8018ba22eaa6113d1
SHA1e778147c2e2c434ba997e96cd4d76dd4cb84ca42
SHA256d6b47354dff2693d279b357d0901496908922679207ebef447e78160cd45bdf3
SHA5121b1615a9753f8eafdafd9381265ef78e2e7bef3e1f26553ceb8d9c734a0cfbb83eb33ef488d927c53093dfd644ab8ce11203aa2aa69a0384cdafcedff9df4bcd
-
\Users\Admin\AppData\Local\Temp\92CD.exeMD5
7f98e524346266f8018ba22eaa6113d1
SHA1e778147c2e2c434ba997e96cd4d76dd4cb84ca42
SHA256d6b47354dff2693d279b357d0901496908922679207ebef447e78160cd45bdf3
SHA5121b1615a9753f8eafdafd9381265ef78e2e7bef3e1f26553ceb8d9c734a0cfbb83eb33ef488d927c53093dfd644ab8ce11203aa2aa69a0384cdafcedff9df4bcd
-
memory/772-58-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/772-57-0x0000000000402F47-mapping.dmp
-
memory/772-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/824-67-0x0000000000402F47-mapping.dmp
-
memory/1212-60-0x0000000002A20000-0x0000000002A36000-memory.dmpFilesize
88KB
-
memory/1212-70-0x0000000003CD0000-0x0000000003CE6000-memory.dmpFilesize
88KB
-
memory/1764-61-0x0000000000000000-mapping.dmp
-
memory/1764-63-0x0000000000668000-0x0000000000679000-memory.dmpFilesize
68KB
-
memory/1992-59-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/1992-55-0x0000000000588000-0x0000000000599000-memory.dmpFilesize
68KB