Analysis
-
max time kernel
151s -
max time network
127s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 20:05
Static task
static1
Behavioral task
behavioral1
Sample
e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe
Resource
win10-en-20211208
General
-
Target
e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe
-
Size
317KB
-
MD5
a21c8d80fb1a92c97c92b4e9dbb55157
-
SHA1
22aabf615fac867c3b51b5e71df1f3cc24a88cf1
-
SHA256
e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902
-
SHA512
f489064bfdec5980f621f90aa6fcd235db51a2acf691588247ad3bc069e0959c05594ff7363aff0050a488b4e31d58e569fc80668f25310a9e371fbd25e8887b
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2072 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exedescription pid process target process PID 3796 set thread context of 624 3796 e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exepid process 624 e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe 624 e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2072 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exepid process 624 e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exedescription pid process target process PID 3796 wrote to memory of 624 3796 e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe PID 3796 wrote to memory of 624 3796 e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe PID 3796 wrote to memory of 624 3796 e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe PID 3796 wrote to memory of 624 3796 e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe PID 3796 wrote to memory of 624 3796 e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe PID 3796 wrote to memory of 624 3796 e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe"C:\Users\Admin\AppData\Local\Temp\e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe"C:\Users\Admin\AppData\Local\Temp\e5e0bcf2610d627a33bb7220435e7752318c3f2323998c16360221ccf7fc7902.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/624-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/624-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2072-118-0x0000000000DF0000-0x0000000000E06000-memory.dmpFilesize
88KB
-
memory/3796-116-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB