Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
25-01-2022 13:31
Static task
static1
Behavioral task
behavioral1
Sample
533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe
Resource
win10v2004-en-20220112
General
-
Target
533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe
-
Size
317KB
-
MD5
ba3bd892830fade9c9668ad1a72cf7b0
-
SHA1
5b4e26f8cd995ffa6a4212f0c7bc65b66171e3d0
-
SHA256
533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693
-
SHA512
edfb7f920bbb9aca00f505124ee77f47a55ca482a51b46a7a0398752d3c4f69953d4fc436cf7ef4bcd2605e7d2234973514392e49680529b1b5eaabad2a10401
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
asvteacasvteacpid process 3056 asvteac 3284 asvteac -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exeasvteacdescription pid process target process PID 1576 set thread context of 3836 1576 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe PID 3056 set thread context of 3284 3056 asvteac asvteac -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exeasvteacdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI asvteac Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI asvteac Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI asvteac -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exepid process 3836 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe 3836 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2432 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exeasvteacpid process 3836 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe 3284 asvteac -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exeasvteacdescription pid process target process PID 1576 wrote to memory of 3836 1576 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe PID 1576 wrote to memory of 3836 1576 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe PID 1576 wrote to memory of 3836 1576 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe PID 1576 wrote to memory of 3836 1576 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe PID 1576 wrote to memory of 3836 1576 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe PID 1576 wrote to memory of 3836 1576 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe 533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe PID 3056 wrote to memory of 3284 3056 asvteac asvteac PID 3056 wrote to memory of 3284 3056 asvteac asvteac PID 3056 wrote to memory of 3284 3056 asvteac asvteac PID 3056 wrote to memory of 3284 3056 asvteac asvteac PID 3056 wrote to memory of 3284 3056 asvteac asvteac PID 3056 wrote to memory of 3284 3056 asvteac asvteac
Processes
-
C:\Users\Admin\AppData\Local\Temp\533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe"C:\Users\Admin\AppData\Local\Temp\533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe"C:\Users\Admin\AppData\Local\Temp\533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3836
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 22fb4940d8a0b4fc16266e0336e74e27 BGQEXfaXXUSNy+AvXw5Ntg.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3228
-
C:\Users\Admin\AppData\Roaming\asvteacC:\Users\Admin\AppData\Roaming\asvteac1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Roaming\asvteacC:\Users\Admin\AppData\Roaming\asvteac2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3284
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\asvteacMD5
ba3bd892830fade9c9668ad1a72cf7b0
SHA15b4e26f8cd995ffa6a4212f0c7bc65b66171e3d0
SHA256533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693
SHA512edfb7f920bbb9aca00f505124ee77f47a55ca482a51b46a7a0398752d3c4f69953d4fc436cf7ef4bcd2605e7d2234973514392e49680529b1b5eaabad2a10401
-
C:\Users\Admin\AppData\Roaming\asvteacMD5
ba3bd892830fade9c9668ad1a72cf7b0
SHA15b4e26f8cd995ffa6a4212f0c7bc65b66171e3d0
SHA256533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693
SHA512edfb7f920bbb9aca00f505124ee77f47a55ca482a51b46a7a0398752d3c4f69953d4fc436cf7ef4bcd2605e7d2234973514392e49680529b1b5eaabad2a10401
-
C:\Users\Admin\AppData\Roaming\asvteacMD5
ba3bd892830fade9c9668ad1a72cf7b0
SHA15b4e26f8cd995ffa6a4212f0c7bc65b66171e3d0
SHA256533e02f8c0d7322c9bd27e988c805152994108e0abd1f1d61b5d3f52edebb693
SHA512edfb7f920bbb9aca00f505124ee77f47a55ca482a51b46a7a0398752d3c4f69953d4fc436cf7ef4bcd2605e7d2234973514392e49680529b1b5eaabad2a10401
-
memory/1576-131-0x00000000004C0000-0x00000000004C8000-memory.dmpFilesize
32KB
-
memory/1576-132-0x00000000004D0000-0x00000000004D9000-memory.dmpFilesize
36KB
-
memory/2432-134-0x0000000000BA0000-0x0000000000BB6000-memory.dmpFilesize
88KB
-
memory/2432-141-0x0000000000BD0000-0x0000000000BE6000-memory.dmpFilesize
88KB
-
memory/3056-139-0x00000000004C0000-0x00000000004C8000-memory.dmpFilesize
32KB
-
memory/3284-140-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3836-130-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3836-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB