Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 18:37
Static task
static1
Behavioral task
behavioral1
Sample
182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe
Resource
win10-en-20211208
General
-
Target
182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe
-
Size
318KB
-
MD5
3de9203eef366d23f9d05d500457eff7
-
SHA1
01d80b33a0e6baa0f899b5165fb9ac2f9c7b1e5c
-
SHA256
182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf
-
SHA512
4dcfec5cb57d16f3db44c3189746a24284c4120529510bc34d726bc7962975a4a0a6c4866221aadc42b1298b57ff830e4b58377b9c9e2a1616210297a88ba2e3
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2892 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exedescription pid process target process PID 2728 set thread context of 2116 2728 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exepid process 2116 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe 2116 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2892 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exepid process 2116 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exedescription pid process target process PID 2728 wrote to memory of 2116 2728 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe PID 2728 wrote to memory of 2116 2728 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe PID 2728 wrote to memory of 2116 2728 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe PID 2728 wrote to memory of 2116 2728 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe PID 2728 wrote to memory of 2116 2728 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe PID 2728 wrote to memory of 2116 2728 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe 182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe"C:\Users\Admin\AppData\Local\Temp\182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe"C:\Users\Admin\AppData\Local\Temp\182d8c325b63819e85ae976ec2b91211eb554333d1d5fdc21d99f77737f4eecf.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2116-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2116-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2728-116-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/2892-118-0x00000000013C0000-0x00000000013D6000-memory.dmpFilesize
88KB