Analysis
-
max time kernel
163s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 12:54
Static task
static1
Behavioral task
behavioral1
Sample
46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe
Resource
win10-en-20211208
General
-
Target
46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe
-
Size
318KB
-
MD5
02bf0331456683ec4c6a1433e55e9917
-
SHA1
c759ab957dd9e48c6310902fea1e3d09457429e3
-
SHA256
46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573
-
SHA512
f5378d2ebf5d3145646d2dbdb36fcc7b125f46a853968d78492347d9862c50807edfb53cf5e825f02f0a51da483b2ac8bd634435867d5c99b410b740d469d79a
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2648 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exedescription pid process target process PID 732 set thread context of 1364 732 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exepid process 1364 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe 1364 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2648 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exepid process 1364 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exedescription pid process target process PID 732 wrote to memory of 1364 732 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe PID 732 wrote to memory of 1364 732 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe PID 732 wrote to memory of 1364 732 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe PID 732 wrote to memory of 1364 732 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe PID 732 wrote to memory of 1364 732 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe PID 732 wrote to memory of 1364 732 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe 46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe"C:\Users\Admin\AppData\Local\Temp\46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe"C:\Users\Admin\AppData\Local\Temp\46fa40f135502b6cad94851a4f2ee98cb30fd772090af867eb957531052a0573.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1364
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/732-116-0x00000000005B0000-0x00000000005B9000-memory.dmpFilesize
36KB
-
memory/732-115-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1364-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1364-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2648-119-0x0000000000B40000-0x0000000000B56000-memory.dmpFilesize
88KB