Analysis
-
max time kernel
159s -
max time network
139s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 03:19
Static task
static1
Behavioral task
behavioral1
Sample
8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe
Resource
win10-en-20211208
General
-
Target
8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe
-
Size
333KB
-
MD5
475a9ca45db354c6880c465170716bc0
-
SHA1
8eaf445ee11452ce953fb7356117a27edf140348
-
SHA256
8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566
-
SHA512
a48371defbd1dddf203829074cd8ebc4f8a3609a0d38d1f1f3ba21af3ac8861ee68253be44bbea5741b7da103f26ab912fbad2a50492b09fc359b39eb785b710
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2712 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exedescription pid process target process PID 456 set thread context of 2912 456 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exepid process 2912 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe 2912 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2712 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exepid process 2912 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exedescription pid process target process PID 456 wrote to memory of 2912 456 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe PID 456 wrote to memory of 2912 456 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe PID 456 wrote to memory of 2912 456 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe PID 456 wrote to memory of 2912 456 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe PID 456 wrote to memory of 2912 456 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe PID 456 wrote to memory of 2912 456 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe 8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe"C:\Users\Admin\AppData\Local\Temp\8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe"C:\Users\Admin\AppData\Local\Temp\8c8242d6c4ec51bb06cba19b8e65b0383d34b16208d62aa4c27dbe3339823566.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/456-116-0x00000000005A0000-0x00000000005A9000-memory.dmpFilesize
36KB
-
memory/2712-119-0x0000000000720000-0x0000000000736000-memory.dmpFilesize
88KB
-
memory/2912-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2912-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB