Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 08:09
Static task
static1
Behavioral task
behavioral1
Sample
aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe
Resource
win10-en-20211208
General
-
Target
aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe
-
Size
317KB
-
MD5
fbcf4e4b6e3bcd555ad2133be98239c2
-
SHA1
720033f26905a78402df4e2d9d1008f6eea1d99d
-
SHA256
aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc
-
SHA512
0e1138e6aa098c52c72df30394cfc7228a30305c42e13a898a382ab702f03f73bb5a2147194031ff273fa825fc3a7c0c8971b96a9dac8dd2f5cdbe6deabe7abb
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2364 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exedescription pid process target process PID 2588 set thread context of 3148 2588 aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exepid process 3148 aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe 3148 aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2364 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exepid process 3148 aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exedescription pid process target process PID 2588 wrote to memory of 3148 2588 aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe PID 2588 wrote to memory of 3148 2588 aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe PID 2588 wrote to memory of 3148 2588 aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe PID 2588 wrote to memory of 3148 2588 aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe PID 2588 wrote to memory of 3148 2588 aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe PID 2588 wrote to memory of 3148 2588 aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe"C:\Users\Admin\AppData\Local\Temp\aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe"C:\Users\Admin\AppData\Local\Temp\aca04a14497073faafb60565c04b170988ec91c93952c7e9401d63156a477ccc.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2364-119-0x0000000000E70000-0x0000000000E86000-memory.dmpFilesize
88KB
-
memory/2588-116-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/2588-117-0x0000000000530000-0x0000000000539000-memory.dmpFilesize
36KB
-
memory/3148-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3148-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB