Analysis
-
max time kernel
164s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
26-01-2022 00:23
Static task
static1
Behavioral task
behavioral1
Sample
bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe
Resource
win10v2004-en-20220112
General
-
Target
bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe
-
Size
318KB
-
MD5
9e5b2e4f56f3380389362b790aa17b44
-
SHA1
7a2f8ee8e21dbf10f5bd84f538a6621dc32f8f84
-
SHA256
bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676
-
SHA512
7207936d2e544e94016098a0aa07822c85d555eaea02d774631268c4f6c7a423bc686653e1a1b7d70b6d52bf3b7d1548ccc517dc1d5340b2f7f3b3514def2aa7
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
iugfbvuiugfbvupid process 3684 iugfbvu 2704 iugfbvu -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exeiugfbvudescription pid process target process PID 3500 set thread context of 1324 3500 bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe PID 3684 set thread context of 2704 3684 iugfbvu iugfbvu -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
iugfbvubd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iugfbvu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iugfbvu Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iugfbvu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exepid process 1324 bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe 1324 bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 2452 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2452 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exeiugfbvupid process 1324 bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe 2704 iugfbvu -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2452 Token: SeCreatePagefilePrivilege 2452 Token: SeShutdownPrivilege 2452 Token: SeCreatePagefilePrivilege 2452 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exeiugfbvudescription pid process target process PID 3500 wrote to memory of 1324 3500 bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe PID 3500 wrote to memory of 1324 3500 bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe PID 3500 wrote to memory of 1324 3500 bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe PID 3500 wrote to memory of 1324 3500 bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe PID 3500 wrote to memory of 1324 3500 bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe PID 3500 wrote to memory of 1324 3500 bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe PID 3684 wrote to memory of 2704 3684 iugfbvu iugfbvu PID 3684 wrote to memory of 2704 3684 iugfbvu iugfbvu PID 3684 wrote to memory of 2704 3684 iugfbvu iugfbvu PID 3684 wrote to memory of 2704 3684 iugfbvu iugfbvu PID 3684 wrote to memory of 2704 3684 iugfbvu iugfbvu PID 3684 wrote to memory of 2704 3684 iugfbvu iugfbvu
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe"C:\Users\Admin\AppData\Local\Temp\bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe"C:\Users\Admin\AppData\Local\Temp\bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe f86e59f2b81a522798e1e68443627023 7csonUkDqECE4mvr7GdPcg.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Roaming\iugfbvuC:\Users\Admin\AppData\Roaming\iugfbvu1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\iugfbvuC:\Users\Admin\AppData\Roaming\iugfbvu2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\iugfbvuMD5
9e5b2e4f56f3380389362b790aa17b44
SHA17a2f8ee8e21dbf10f5bd84f538a6621dc32f8f84
SHA256bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676
SHA5127207936d2e544e94016098a0aa07822c85d555eaea02d774631268c4f6c7a423bc686653e1a1b7d70b6d52bf3b7d1548ccc517dc1d5340b2f7f3b3514def2aa7
-
C:\Users\Admin\AppData\Roaming\iugfbvuMD5
9e5b2e4f56f3380389362b790aa17b44
SHA17a2f8ee8e21dbf10f5bd84f538a6621dc32f8f84
SHA256bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676
SHA5127207936d2e544e94016098a0aa07822c85d555eaea02d774631268c4f6c7a423bc686653e1a1b7d70b6d52bf3b7d1548ccc517dc1d5340b2f7f3b3514def2aa7
-
C:\Users\Admin\AppData\Roaming\iugfbvuMD5
9e5b2e4f56f3380389362b790aa17b44
SHA17a2f8ee8e21dbf10f5bd84f538a6621dc32f8f84
SHA256bd47a6c86b0088b8524db00c5c8e6ca98f9f798cf15ae447aeb789e881663676
SHA5127207936d2e544e94016098a0aa07822c85d555eaea02d774631268c4f6c7a423bc686653e1a1b7d70b6d52bf3b7d1548ccc517dc1d5340b2f7f3b3514def2aa7
-
memory/1324-132-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1324-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2452-134-0x0000000000410000-0x0000000000426000-memory.dmpFilesize
88KB
-
memory/2452-140-0x0000000000440000-0x0000000000456000-memory.dmpFilesize
88KB
-
memory/2704-139-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3500-131-0x00000000005B0000-0x00000000005B9000-memory.dmpFilesize
36KB
-
memory/3500-130-0x00000000005A0000-0x00000000005A9000-memory.dmpFilesize
36KB