Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 16:48
Static task
static1
Behavioral task
behavioral1
Sample
f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe
Resource
win10-en-20211208
General
-
Target
f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe
-
Size
264KB
-
MD5
f6b424927a4dc9dca4af3a6cd65b9f2f
-
SHA1
08ce93426c773bdbefd7b84e65a6a566a3cf71eb
-
SHA256
f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174
-
SHA512
39ee68439b7152a5d766da60ece438eb4ed16bd76e51c456cbbf99cac3b5792a54bb0a55aab6ddcb363bbef5ac96d55361def0eae995b2705dbfcb2ae5d60337
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2984 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exedescription pid process target process PID 748 set thread context of 3636 748 f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exepid process 3636 f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe 3636 f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2984 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exepid process 3636 f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exedescription pid process target process PID 748 wrote to memory of 3636 748 f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe PID 748 wrote to memory of 3636 748 f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe PID 748 wrote to memory of 3636 748 f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe PID 748 wrote to memory of 3636 748 f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe PID 748 wrote to memory of 3636 748 f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe PID 748 wrote to memory of 3636 748 f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe"C:\Users\Admin\AppData\Local\Temp\f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe"C:\Users\Admin\AppData\Local\Temp\f483847c2464fad95905c77776eae65e23f5d0ff7a406f7f6a9c9decf05c9174.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3636
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/748-116-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/2984-118-0x0000000000A00000-0x0000000000A16000-memory.dmpFilesize
88KB
-
memory/3636-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3636-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB