Analysis
-
max time kernel
157s -
max time network
138s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 15:23
Static task
static1
Behavioral task
behavioral1
Sample
086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe
Resource
win10-en-20211208
General
-
Target
086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe
-
Size
264KB
-
MD5
685f816724017aa6b2335aa7ed44fd16
-
SHA1
3e8ae9e1f743f17449fc9266eb7d2fd2e3fbec45
-
SHA256
086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3
-
SHA512
90a43735ba64b7957f73e1997deece34b7d2f15a98ea3ee7fdc3a2d0f91b9cc2cb96f8555f7c9c9f6d6baa4add91ec80c38bf9030b756021c3df4911e1e0bf9d
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2984 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exedescription pid process target process PID 4048 set thread context of 1520 4048 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exepid process 1520 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe 1520 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2984 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exepid process 1520 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exedescription pid process target process PID 4048 wrote to memory of 1520 4048 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe PID 4048 wrote to memory of 1520 4048 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe PID 4048 wrote to memory of 1520 4048 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe PID 4048 wrote to memory of 1520 4048 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe PID 4048 wrote to memory of 1520 4048 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe PID 4048 wrote to memory of 1520 4048 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe 086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe"C:\Users\Admin\AppData\Local\Temp\086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe"C:\Users\Admin\AppData\Local\Temp\086491bebac8a56d7da2e01a7061b1db88d060b1f2a53ab6be324396a2ce5ee3.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1520-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1520-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2984-122-0x0000000000A00000-0x0000000000A16000-memory.dmpFilesize
88KB
-
memory/4048-119-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/4048-120-0x0000000000520000-0x0000000000529000-memory.dmpFilesize
36KB