Analysis
-
max time kernel
154s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 09:30
Static task
static1
Behavioral task
behavioral1
Sample
048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe
Resource
win10-en-20211208
General
-
Target
048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe
-
Size
317KB
-
MD5
f278ddb06207d8c46951b3e3d55f9c26
-
SHA1
7b6c9e568ee54a64e5cbeed1dd0e1fcedd551603
-
SHA256
048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2
-
SHA512
68277d5f2ad477ab09162d923e134f31b3b67e1a1d5ffe1cbe5be9e48a26f4b3a32916563ffec2b1df145bd346bd6c9bdaab1495a3e9d873a212a07bf4fcfd69
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2880 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exedescription pid process target process PID 2808 set thread context of 3160 2808 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exepid process 3160 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe 3160 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 2880 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2880 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exepid process 3160 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exedescription pid process target process PID 2808 wrote to memory of 3160 2808 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe PID 2808 wrote to memory of 3160 2808 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe PID 2808 wrote to memory of 3160 2808 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe PID 2808 wrote to memory of 3160 2808 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe PID 2808 wrote to memory of 3160 2808 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe PID 2808 wrote to memory of 3160 2808 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe 048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe"C:\Users\Admin\AppData\Local\Temp\048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe"C:\Users\Admin\AppData\Local\Temp\048db445bc84e7a3ccb94098e043df99752344c0d41da2b8594eae8dc40cd1b2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2808-116-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/2880-118-0x0000000001040000-0x0000000001056000-memory.dmpFilesize
88KB
-
memory/3160-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3160-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB