Analysis
-
max time kernel
163s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 23:39
Static task
static1
Behavioral task
behavioral1
Sample
9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe
Resource
win10-en-20211208
General
-
Target
9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe
-
Size
317KB
-
MD5
192cc5cdd85785947361ecf901bf257b
-
SHA1
182e6e4434ad04c92023c2debd9c2253fa43b5b7
-
SHA256
9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92
-
SHA512
cacc643492c1e4f24eb185037e35d472ea161eebadb0095dd474a7d45d9f54e24ca878abe29b591a0b228483a13df416db233d12855852795a5cf4199a4790f8
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3044 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exedescription pid process target process PID 2712 set thread context of 1644 2712 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exepid process 1644 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe 1644 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3044 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exepid process 1644 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exedescription pid process target process PID 2712 wrote to memory of 1644 2712 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe PID 2712 wrote to memory of 1644 2712 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe PID 2712 wrote to memory of 1644 2712 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe PID 2712 wrote to memory of 1644 2712 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe PID 2712 wrote to memory of 1644 2712 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe PID 2712 wrote to memory of 1644 2712 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe 9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe"C:\Users\Admin\AppData\Local\Temp\9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe"C:\Users\Admin\AppData\Local\Temp\9f550a6f982849e7e941996477f34ea0271d266f7b8d6a49dd911730b325cb92.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1644-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1644-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2712-116-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/3044-118-0x0000000001130000-0x0000000001146000-memory.dmpFilesize
88KB