Analysis
-
max time kernel
156s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
25-01-2022 16:09
Static task
static1
Behavioral task
behavioral1
Sample
55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe
Resource
win10v2004-en-20220112
General
-
Target
55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe
-
Size
264KB
-
MD5
2c9c93a67aa6cbcb5fec425b62556148
-
SHA1
cb981f95bb064332fb05c680bef4bac220e18a60
-
SHA256
55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f
-
SHA512
cc53ab8fd382dd05310cebfa474a0125b7072a8043551e34698eee60ad63b651ae2f19179197ee9c97093c0ebf551706b032877c4ab55163153f53bdc74d9c3a
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
svghihcsvghihcpid process 3428 svghihc 3044 svghihc -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exesvghihcdescription pid process target process PID 3416 set thread context of 1964 3416 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe PID 3428 set thread context of 3044 3428 svghihc svghihc -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exesvghihcdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI svghihc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI svghihc Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI svghihc -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exepid process 1964 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe 1964 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2420 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exesvghihcpid process 1964 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe 3044 svghihc -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2420 Token: SeCreatePagefilePrivilege 2420 Token: SeShutdownPrivilege 2420 Token: SeCreatePagefilePrivilege 2420 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exesvghihcdescription pid process target process PID 3416 wrote to memory of 1964 3416 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe PID 3416 wrote to memory of 1964 3416 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe PID 3416 wrote to memory of 1964 3416 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe PID 3416 wrote to memory of 1964 3416 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe PID 3416 wrote to memory of 1964 3416 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe PID 3416 wrote to memory of 1964 3416 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe 55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe PID 3428 wrote to memory of 3044 3428 svghihc svghihc PID 3428 wrote to memory of 3044 3428 svghihc svghihc PID 3428 wrote to memory of 3044 3428 svghihc svghihc PID 3428 wrote to memory of 3044 3428 svghihc svghihc PID 3428 wrote to memory of 3044 3428 svghihc svghihc PID 3428 wrote to memory of 3044 3428 svghihc svghihc
Processes
-
C:\Users\Admin\AppData\Local\Temp\55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe"C:\Users\Admin\AppData\Local\Temp\55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe"C:\Users\Admin\AppData\Local\Temp\55cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe b50832d2b12f350e0061469a625bd568 r0ohSL2Ws0SN2Pjcvoljkw.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Roaming\svghihcC:\Users\Admin\AppData\Roaming\svghihc1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svghihcC:\Users\Admin\AppData\Roaming\svghihc2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\svghihcMD5
2c9c93a67aa6cbcb5fec425b62556148
SHA1cb981f95bb064332fb05c680bef4bac220e18a60
SHA25655cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f
SHA512cc53ab8fd382dd05310cebfa474a0125b7072a8043551e34698eee60ad63b651ae2f19179197ee9c97093c0ebf551706b032877c4ab55163153f53bdc74d9c3a
-
C:\Users\Admin\AppData\Roaming\svghihcMD5
2c9c93a67aa6cbcb5fec425b62556148
SHA1cb981f95bb064332fb05c680bef4bac220e18a60
SHA25655cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f
SHA512cc53ab8fd382dd05310cebfa474a0125b7072a8043551e34698eee60ad63b651ae2f19179197ee9c97093c0ebf551706b032877c4ab55163153f53bdc74d9c3a
-
C:\Users\Admin\AppData\Roaming\svghihcMD5
2c9c93a67aa6cbcb5fec425b62556148
SHA1cb981f95bb064332fb05c680bef4bac220e18a60
SHA25655cbf86dbb5b1fe99a3502f383798cc15466454334df3bc4c3ffdfb95bc57c2f
SHA512cc53ab8fd382dd05310cebfa474a0125b7072a8043551e34698eee60ad63b651ae2f19179197ee9c97093c0ebf551706b032877c4ab55163153f53bdc74d9c3a
-
memory/1964-130-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1964-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2420-134-0x0000000000D10000-0x0000000000D26000-memory.dmpFilesize
88KB
-
memory/2420-147-0x0000000000D40000-0x0000000000D56000-memory.dmpFilesize
88KB
-
memory/3416-131-0x0000000000890000-0x0000000000898000-memory.dmpFilesize
32KB
-
memory/3416-132-0x00000000008A0000-0x00000000008A9000-memory.dmpFilesize
36KB
-
memory/3428-144-0x0000000000580000-0x0000000000588000-memory.dmpFilesize
32KB