Analysis
-
max time kernel
151s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 07:49
Static task
static1
Behavioral task
behavioral1
Sample
b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe
Resource
win10-en-20211208
General
-
Target
b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe
-
Size
317KB
-
MD5
cb7949946e09f956b7e983a0bd22e7e4
-
SHA1
9e4a562b893299f7194969322e08efbd1c7c364e
-
SHA256
b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f
-
SHA512
2accdc1e0c395680469dd7bab24a59fdb4525a696cb1f734599ff8f0a27f114527e7bb344e5d5306d5938fba948fe1f28a5733d5cb38e9354ce7b56ac85ec4d5
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3036 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exedescription pid process target process PID 2668 set thread context of 816 2668 b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exepid process 816 b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe 816 b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3036 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exepid process 816 b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exedescription pid process target process PID 2668 wrote to memory of 816 2668 b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe PID 2668 wrote to memory of 816 2668 b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe PID 2668 wrote to memory of 816 2668 b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe PID 2668 wrote to memory of 816 2668 b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe PID 2668 wrote to memory of 816 2668 b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe PID 2668 wrote to memory of 816 2668 b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe"C:\Users\Admin\AppData\Local\Temp\b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe"C:\Users\Admin\AppData\Local\Temp\b0f64e103052539e013986c8884dd5101883a8f6b02f0e42216be1f9902bf48f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/816-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/816-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2668-115-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/2668-116-0x00000000005B0000-0x00000000005B9000-memory.dmpFilesize
36KB
-
memory/3036-119-0x0000000001120000-0x0000000001136000-memory.dmpFilesize
88KB