Analysis
-
max time kernel
168s -
max time network
155s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 01:33
Static task
static1
Behavioral task
behavioral1
Sample
f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe
Resource
win10-en-20211208
General
-
Target
f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe
-
Size
333KB
-
MD5
0536b5a0b88962a127c9b7d61aed800f
-
SHA1
7df17a0ee632b715bc59d046758d101f49ae7b16
-
SHA256
f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a
-
SHA512
cba36828b30a108c5b247f7fd9cf4d06e6fce4655f6dcafd1b818d8917349633c964e772ed0fa9280e39003b7d31bd9fa1788c848344c872d750bd089aaf152b
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 396 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exedescription pid process target process PID 3780 set thread context of 4004 3780 f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exepid process 4004 f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe 4004 f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 396 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exepid process 4004 f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exedescription pid process target process PID 3780 wrote to memory of 4004 3780 f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe PID 3780 wrote to memory of 4004 3780 f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe PID 3780 wrote to memory of 4004 3780 f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe PID 3780 wrote to memory of 4004 3780 f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe PID 3780 wrote to memory of 4004 3780 f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe PID 3780 wrote to memory of 4004 3780 f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe"C:\Users\Admin\AppData\Local\Temp\f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe"C:\Users\Admin\AppData\Local\Temp\f936a3ac2486ad5bfe089b52d45b4fdfb8be257f257cf730b54541fc0d2c743a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-122-0x0000000000B20000-0x0000000000B36000-memory.dmpFilesize
88KB
-
memory/3780-118-0x00000000007B0000-0x00000000007D8000-memory.dmpFilesize
160KB
-
memory/3780-119-0x0000000000660000-0x0000000000669000-memory.dmpFilesize
36KB
-
memory/4004-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4004-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB