Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 16:43
Static task
static1
Behavioral task
behavioral1
Sample
629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe
Resource
win10-en-20211208
General
-
Target
629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe
-
Size
264KB
-
MD5
3ff4d9500813d3fc8f44b1397cf214a1
-
SHA1
1bee40dd516fdb7ac5325b8d4863520dd5058906
-
SHA256
629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51
-
SHA512
56241ebe45a0de60cce00388076089a0a73e95b089c97d016eef8c4fc9e9c56af1d867dd472dd57032758c9172820be1554d72e828f8956d33c7f1baceb0501c
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3040 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exedescription pid process target process PID 3972 set thread context of 516 3972 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exepid process 516 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe 516 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3040 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exepid process 516 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exedescription pid process target process PID 3972 wrote to memory of 516 3972 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe PID 3972 wrote to memory of 516 3972 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe PID 3972 wrote to memory of 516 3972 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe PID 3972 wrote to memory of 516 3972 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe PID 3972 wrote to memory of 516 3972 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe PID 3972 wrote to memory of 516 3972 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe 629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe"C:\Users\Admin\AppData\Local\Temp\629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe"C:\Users\Admin\AppData\Local\Temp\629b771069d2d7ac3df5c3f3ecde00651724c4635936fc3fea333844a173ef51.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:516
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/516-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/516-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3040-118-0x0000000000CD0000-0x0000000000CE6000-memory.dmpFilesize
88KB
-
memory/3972-116-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB