Analysis
-
max time kernel
155s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
25-01-2022 16:25
Static task
static1
Behavioral task
behavioral1
Sample
d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe
Resource
win10v2004-en-20220112
General
-
Target
d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe
-
Size
264KB
-
MD5
0ba1e64727681ab629be3617e3f1f4c7
-
SHA1
ec1878c56158824f139a2cd63325c33a6910b132
-
SHA256
d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898
-
SHA512
65f6d9b08f6ce19fcb76c0947e2d261110d70004036cf2b546fe3b769da7a2df1e663eca57469ef4b7e6d324ce4d3d96f60243ef4336beddc35fa9f7f791c8fe
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
wiviartwiviartpid process 1340 wiviart 3124 wiviart -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exewiviartdescription pid process target process PID 3256 set thread context of 3944 3256 d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe PID 1340 set thread context of 3124 1340 wiviart wiviart -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
wiviartd56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wiviart Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wiviart Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wiviart -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exepid process 3944 d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe 3944 d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 2384 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2384 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exewiviartpid process 3944 d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe 3124 wiviart -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2384 Token: SeCreatePagefilePrivilege 2384 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exewiviartdescription pid process target process PID 3256 wrote to memory of 3944 3256 d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe PID 3256 wrote to memory of 3944 3256 d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe PID 3256 wrote to memory of 3944 3256 d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe PID 3256 wrote to memory of 3944 3256 d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe PID 3256 wrote to memory of 3944 3256 d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe PID 3256 wrote to memory of 3944 3256 d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe PID 1340 wrote to memory of 3124 1340 wiviart wiviart PID 1340 wrote to memory of 3124 1340 wiviart wiviart PID 1340 wrote to memory of 3124 1340 wiviart wiviart PID 1340 wrote to memory of 3124 1340 wiviart wiviart PID 1340 wrote to memory of 3124 1340 wiviart wiviart PID 1340 wrote to memory of 3124 1340 wiviart wiviart
Processes
-
C:\Users\Admin\AppData\Local\Temp\d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe"C:\Users\Admin\AppData\Local\Temp\d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe"C:\Users\Admin\AppData\Local\Temp\d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3944
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 2584a685c27e79921226bfd985193d20 lQrIatP0sESqbu2kA5qkfA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:2352
-
C:\Users\Admin\AppData\Roaming\wiviartC:\Users\Admin\AppData\Roaming\wiviart1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Roaming\wiviartC:\Users\Admin\AppData\Roaming\wiviart2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵PID:2616
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\wiviartMD5
0ba1e64727681ab629be3617e3f1f4c7
SHA1ec1878c56158824f139a2cd63325c33a6910b132
SHA256d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898
SHA51265f6d9b08f6ce19fcb76c0947e2d261110d70004036cf2b546fe3b769da7a2df1e663eca57469ef4b7e6d324ce4d3d96f60243ef4336beddc35fa9f7f791c8fe
-
C:\Users\Admin\AppData\Roaming\wiviartMD5
0ba1e64727681ab629be3617e3f1f4c7
SHA1ec1878c56158824f139a2cd63325c33a6910b132
SHA256d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898
SHA51265f6d9b08f6ce19fcb76c0947e2d261110d70004036cf2b546fe3b769da7a2df1e663eca57469ef4b7e6d324ce4d3d96f60243ef4336beddc35fa9f7f791c8fe
-
C:\Users\Admin\AppData\Roaming\wiviartMD5
0ba1e64727681ab629be3617e3f1f4c7
SHA1ec1878c56158824f139a2cd63325c33a6910b132
SHA256d56e96786b2291d678e764febe65570be5d501d79f6e02903e1afb5ea2c71898
SHA51265f6d9b08f6ce19fcb76c0947e2d261110d70004036cf2b546fe3b769da7a2df1e663eca57469ef4b7e6d324ce4d3d96f60243ef4336beddc35fa9f7f791c8fe
-
memory/1340-139-0x0000000000540000-0x0000000000549000-memory.dmpFilesize
36KB
-
memory/2384-134-0x00000000007E0000-0x00000000007F6000-memory.dmpFilesize
88KB
-
memory/2384-141-0x0000000000810000-0x0000000000826000-memory.dmpFilesize
88KB
-
memory/3124-140-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3256-131-0x00000000005C0000-0x00000000005C9000-memory.dmpFilesize
36KB
-
memory/3256-130-0x00000000005B0000-0x00000000005B9000-memory.dmpFilesize
36KB
-
memory/3944-132-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3944-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB