Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 23:00
Static task
static1
Behavioral task
behavioral1
Sample
a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe
Resource
win10-en-20211208
General
-
Target
a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe
-
Size
317KB
-
MD5
de6336b5b2b52add05e25d94a7b297c3
-
SHA1
943f4ca68bd78535f6038a7d1fc14623588b1e18
-
SHA256
a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc
-
SHA512
0bd11a4fa25554e2193aff435d3fd847056991e249ff70cb27186b69da9d6c9bb33c09e8f030a8713fc7e6b534abc67f752adfe8e2441157a135b02379c6f27b
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3044 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exedescription pid process target process PID 2672 set thread context of 3852 2672 a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exepid process 3852 a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe 3852 a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3044 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exepid process 3852 a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exedescription pid process target process PID 2672 wrote to memory of 3852 2672 a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe PID 2672 wrote to memory of 3852 2672 a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe PID 2672 wrote to memory of 3852 2672 a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe PID 2672 wrote to memory of 3852 2672 a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe PID 2672 wrote to memory of 3852 2672 a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe PID 2672 wrote to memory of 3852 2672 a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe"C:\Users\Admin\AppData\Local\Temp\a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe"C:\Users\Admin\AppData\Local\Temp\a95f194e921555f4b2c64675c12c0fe22d74a145c298274fe48700a9791f0dcc.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2672-116-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/2672-117-0x0000000000530000-0x0000000000539000-memory.dmpFilesize
36KB
-
memory/3044-119-0x0000000001130000-0x0000000001146000-memory.dmpFilesize
88KB
-
memory/3852-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3852-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB