Analysis
-
max time kernel
152s -
max time network
143s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 20:46
Static task
static1
Behavioral task
behavioral1
Sample
ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe
Resource
win10-en-20211208
General
-
Target
ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe
-
Size
317KB
-
MD5
dda5109fc19bf764a2cf5cf97f01cf4f
-
SHA1
9059b30d5c582ddab5b28c2dff4695ccb44be8d8
-
SHA256
ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe
-
SHA512
ea2e6d1ecf896b023f10714aaed7629bdccdb415756772be95a1d355cd9dee7027d780e3ec457d2707b3f6f95b1e82e403c298bdb109cd4af8d42e3ee5e5c59b
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3028 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exedescription pid process target process PID 2372 set thread context of 2744 2372 ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exepid process 2744 ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe 2744 ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3028 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exepid process 2744 ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exedescription pid process target process PID 2372 wrote to memory of 2744 2372 ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe PID 2372 wrote to memory of 2744 2372 ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe PID 2372 wrote to memory of 2744 2372 ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe PID 2372 wrote to memory of 2744 2372 ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe PID 2372 wrote to memory of 2744 2372 ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe PID 2372 wrote to memory of 2744 2372 ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe"C:\Users\Admin\AppData\Local\Temp\ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe"C:\Users\Admin\AppData\Local\Temp\ee1692ac25cd9b0619fc8ee462bd96f14e729c87963b8e0ee6bca678aa69aebe.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2372-116-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/2744-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2744-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3028-118-0x00000000008A0000-0x00000000008B6000-memory.dmpFilesize
88KB