Analysis
-
max time kernel
157s -
max time network
143s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 02:58
Static task
static1
Behavioral task
behavioral1
Sample
0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe
Resource
win10-en-20211208
General
-
Target
0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe
-
Size
333KB
-
MD5
acb466ece68c5fb82de4222b46f8ebf1
-
SHA1
e96ef1c1cfb61900dd30834e8cb0a335a7bb7d56
-
SHA256
0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8
-
SHA512
7e88f3a7621c25e0e3a6495f76061b4bb6c9fd970ccff40a9919fc2429a303b5cbc889a775affb8b429e30857d6aab2ae0c33a8f3a6c1a65e4baf6bc1bf82aaf
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3028 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exedescription pid process target process PID 2360 set thread context of 2708 2360 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exepid process 2708 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe 2708 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3028 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exepid process 2708 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exedescription pid process target process PID 2360 wrote to memory of 2708 2360 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe PID 2360 wrote to memory of 2708 2360 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe PID 2360 wrote to memory of 2708 2360 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe PID 2360 wrote to memory of 2708 2360 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe PID 2360 wrote to memory of 2708 2360 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe PID 2360 wrote to memory of 2708 2360 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe 0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe"C:\Users\Admin\AppData\Local\Temp\0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe"C:\Users\Admin\AppData\Local\Temp\0f7d23ec572834adfebb14f7d843b7fa9752c041646e43ed7e263b51d9cfc2e8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2360-116-0x0000000000520000-0x00000000005CE000-memory.dmpFilesize
696KB
-
memory/2708-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2708-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3028-119-0x00000000008A0000-0x00000000008B6000-memory.dmpFilesize
88KB