Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-12-2021 10:56
Static task
static1
Behavioral task
behavioral1
Sample
f33cc6195f6cba82a9406404368f2a25.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f33cc6195f6cba82a9406404368f2a25.exe
Resource
win10-en-20211208
General
-
Target
f33cc6195f6cba82a9406404368f2a25.exe
-
Size
134KB
-
MD5
f33cc6195f6cba82a9406404368f2a25
-
SHA1
25b466416cb495b25891f0015b587de939ba858f
-
SHA256
0adcdd7612a39e133675c677f72fd5a76e8597b59338e43ff5263f45af6d2a2a
-
SHA512
86e211644c0d6c8cb7cb8a929ffeef63314c31bae59d233c65dd4d5a09a4dacc03503898fd617bdcd5622518c9d11ea8aef553fb87e9755019d4d4cb2851e76f
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1200 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f33cc6195f6cba82a9406404368f2a25.exedescription pid process target process PID 948 set thread context of 1468 948 f33cc6195f6cba82a9406404368f2a25.exe f33cc6195f6cba82a9406404368f2a25.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f33cc6195f6cba82a9406404368f2a25.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f33cc6195f6cba82a9406404368f2a25.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f33cc6195f6cba82a9406404368f2a25.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f33cc6195f6cba82a9406404368f2a25.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f33cc6195f6cba82a9406404368f2a25.exepid process 1468 f33cc6195f6cba82a9406404368f2a25.exe 1468 f33cc6195f6cba82a9406404368f2a25.exe 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f33cc6195f6cba82a9406404368f2a25.exepid process 1468 f33cc6195f6cba82a9406404368f2a25.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1200 1200 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1200 1200 -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
f33cc6195f6cba82a9406404368f2a25.exedescription pid process target process PID 948 wrote to memory of 1468 948 f33cc6195f6cba82a9406404368f2a25.exe f33cc6195f6cba82a9406404368f2a25.exe PID 948 wrote to memory of 1468 948 f33cc6195f6cba82a9406404368f2a25.exe f33cc6195f6cba82a9406404368f2a25.exe PID 948 wrote to memory of 1468 948 f33cc6195f6cba82a9406404368f2a25.exe f33cc6195f6cba82a9406404368f2a25.exe PID 948 wrote to memory of 1468 948 f33cc6195f6cba82a9406404368f2a25.exe f33cc6195f6cba82a9406404368f2a25.exe PID 948 wrote to memory of 1468 948 f33cc6195f6cba82a9406404368f2a25.exe f33cc6195f6cba82a9406404368f2a25.exe PID 948 wrote to memory of 1468 948 f33cc6195f6cba82a9406404368f2a25.exe f33cc6195f6cba82a9406404368f2a25.exe PID 948 wrote to memory of 1468 948 f33cc6195f6cba82a9406404368f2a25.exe f33cc6195f6cba82a9406404368f2a25.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f33cc6195f6cba82a9406404368f2a25.exe"C:\Users\Admin\AppData\Local\Temp\f33cc6195f6cba82a9406404368f2a25.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f33cc6195f6cba82a9406404368f2a25.exe"C:\Users\Admin\AppData\Local\Temp\f33cc6195f6cba82a9406404368f2a25.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-57-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/948-58-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1200-59-0x0000000002540000-0x0000000002556000-memory.dmpFilesize
88KB
-
memory/1468-55-0x0000000000402F47-mapping.dmp
-
memory/1468-54-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1468-56-0x0000000075B51000-0x0000000075B53000-memory.dmpFilesize
8KB