Analysis
-
max time kernel
164s -
max time network
138s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 03:31
Static task
static1
Behavioral task
behavioral1
Sample
12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe
Resource
win10-en-20211208
General
-
Target
12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe
-
Size
333KB
-
MD5
8d10f17b2bcefbb4a5900fe598e7a47e
-
SHA1
a24567aeb3b6da6acf5d22e106cbab723b26b5f3
-
SHA256
12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa
-
SHA512
c84745e8bf26e6c80f10fefe77f0db718a6ed58d1dde6907acf78ad6f5c1af0baa50a39f64b586f7435a9f318f2c81e33d1e57555ac0398a0067b8c45fdec9c2
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3024 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exedescription pid process target process PID 2640 set thread context of 3412 2640 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exepid process 3412 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe 3412 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3024 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exepid process 3412 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exedescription pid process target process PID 2640 wrote to memory of 3412 2640 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe PID 2640 wrote to memory of 3412 2640 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe PID 2640 wrote to memory of 3412 2640 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe PID 2640 wrote to memory of 3412 2640 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe PID 2640 wrote to memory of 3412 2640 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe PID 2640 wrote to memory of 3412 2640 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe 12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe"C:\Users\Admin\AppData\Local\Temp\12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe"C:\Users\Admin\AppData\Local\Temp\12a4172a264558e81727a90091ad29f56c65140941efc7b885f5c504d4027baa.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2640-118-0x0000000000790000-0x00000000007B8000-memory.dmpFilesize
160KB
-
memory/2640-120-0x00000000006F0000-0x00000000006F9000-memory.dmpFilesize
36KB
-
memory/3024-122-0x00000000012D0000-0x00000000012E6000-memory.dmpFilesize
88KB
-
memory/3412-119-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3412-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB