Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 13:12
Static task
static1
Behavioral task
behavioral1
Sample
c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe
Resource
win10-en-20211208
General
-
Target
c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe
-
Size
317KB
-
MD5
7b4d64a54bdb7c343318e2b545874be2
-
SHA1
7853cff208b2ab0ab0428a2c3452e9c8253b0589
-
SHA256
c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86
-
SHA512
6df5762fcf6ed7adbf01e2a2a478bfcbc38fa44c61312d23f45a1159e499f01919e159a478fb0dfee788cf6c61850af59966793d829d62caa331d284543f1cdf
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3024 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exedescription pid process target process PID 3496 set thread context of 4020 3496 c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exepid process 4020 c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe 4020 c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3024 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exepid process 4020 c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exedescription pid process target process PID 3496 wrote to memory of 4020 3496 c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe PID 3496 wrote to memory of 4020 3496 c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe PID 3496 wrote to memory of 4020 3496 c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe PID 3496 wrote to memory of 4020 3496 c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe PID 3496 wrote to memory of 4020 3496 c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe PID 3496 wrote to memory of 4020 3496 c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe"C:\Users\Admin\AppData\Local\Temp\c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe"C:\Users\Admin\AppData\Local\Temp\c587505128baedd3c09fa70595a1102e4422e6845e5622a53370fbb42f5c3f86.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4020
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3024-119-0x00000000004A0000-0x00000000004B6000-memory.dmpFilesize
88KB
-
memory/3496-116-0x0000000000780000-0x0000000000789000-memory.dmpFilesize
36KB
-
memory/3496-115-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/4020-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4020-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB