Analysis
-
max time kernel
153s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 17:31
Static task
static1
Behavioral task
behavioral1
Sample
610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe
Resource
win10-en-20211208
General
-
Target
610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe
-
Size
318KB
-
MD5
6d887183952fa2d7de207e59e1a1392c
-
SHA1
f078c3bf6787f0f5e05f1a8ac32feea3a9e22c4e
-
SHA256
610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2
-
SHA512
d972cadd9469ccbd5bbb58b75b0ec8acf023284a85543ffa568f8aa67ea87aa2fd377a9544983c541fa8a25d3898c9e0d535e96e6a69c7bf93c998984c1be72c
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2760 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exedescription pid process target process PID 660 set thread context of 1856 660 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exepid process 1856 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe 1856 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 2760 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2760 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exepid process 1856 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exedescription pid process target process PID 660 wrote to memory of 1856 660 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe PID 660 wrote to memory of 1856 660 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe PID 660 wrote to memory of 1856 660 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe PID 660 wrote to memory of 1856 660 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe PID 660 wrote to memory of 1856 660 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe PID 660 wrote to memory of 1856 660 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe 610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe"C:\Users\Admin\AppData\Local\Temp\610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe"C:\Users\Admin\AppData\Local\Temp\610a0e6062444afc11c91de5cde8e5c00148453d69bb0de02d6ae1ab495365d2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1856
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/660-115-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/660-116-0x0000000000570000-0x0000000000579000-memory.dmpFilesize
36KB
-
memory/1856-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1856-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2760-119-0x0000000001490000-0x00000000014A6000-memory.dmpFilesize
88KB