Analysis
-
max time kernel
153s -
max time network
131s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 05:10
Static task
static1
Behavioral task
behavioral1
Sample
4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe
Resource
win10-en-20211208
General
-
Target
4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe
-
Size
334KB
-
MD5
fbb44457268b6efc57a7ae00838a62b8
-
SHA1
9504beec3ca9993d6570ff21b4284e4b22415177
-
SHA256
4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df
-
SHA512
9516e4f8ce6f0329c16f62044c1af4d1fa6769c4d9c1a44a0ca613cd98b3a6ed9e62e04bdab9e3b519d45c47abd1147a76d856ef0b5f8e94c5a9636c991bb197
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3040 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exedescription pid process target process PID 2736 set thread context of 3172 2736 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exepid process 3172 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe 3172 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3040 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exepid process 3172 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exedescription pid process target process PID 2736 wrote to memory of 3172 2736 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe PID 2736 wrote to memory of 3172 2736 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe PID 2736 wrote to memory of 3172 2736 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe PID 2736 wrote to memory of 3172 2736 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe PID 2736 wrote to memory of 3172 2736 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe PID 2736 wrote to memory of 3172 2736 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe 4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe"C:\Users\Admin\AppData\Local\Temp\4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe"C:\Users\Admin\AppData\Local\Temp\4301c393a68e3ddf9514ac1b153eab27ac80fbf081faaa0341e115bcfce0b7df.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2736-115-0x0000000000740000-0x0000000000769000-memory.dmpFilesize
164KB
-
memory/2736-117-0x0000000000560000-0x0000000000569000-memory.dmpFilesize
36KB
-
memory/3040-119-0x00000000005C0000-0x00000000005D6000-memory.dmpFilesize
88KB
-
memory/3172-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3172-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB