Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 23:57
Static task
static1
Behavioral task
behavioral1
Sample
d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe
Resource
win10-en-20211208
General
-
Target
d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe
-
Size
241KB
-
MD5
e161b9ac3c23a1d72800e65155b44401
-
SHA1
5fbbcc458668fcb769f47c4aae25ae1b65204b18
-
SHA256
d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f
-
SHA512
9eae73557325907d6315af1491de804c1bed109764591a65214f5b52a74a39d421d5f51e0fb4f6d7bbf3769c03ab1408c9031df7b5ae950c538622e22c7a3d9f
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3048 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exedescription pid process target process PID 2740 set thread context of 3792 2740 d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exepid process 3792 d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe 3792 d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3048 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exepid process 3792 d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exedescription pid process target process PID 2740 wrote to memory of 3792 2740 d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe PID 2740 wrote to memory of 3792 2740 d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe PID 2740 wrote to memory of 3792 2740 d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe PID 2740 wrote to memory of 3792 2740 d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe PID 2740 wrote to memory of 3792 2740 d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe PID 2740 wrote to memory of 3792 2740 d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe"C:\Users\Admin\AppData\Local\Temp\d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe"C:\Users\Admin\AppData\Local\Temp\d6cebfa001549392cfa89ef288999449190e352f41f22f8f78fbd6e65fc43e7f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2740-117-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/3048-119-0x0000000001580000-0x0000000001596000-memory.dmpFilesize
88KB
-
memory/3792-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3792-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB