Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 05:38
Static task
static1
Behavioral task
behavioral1
Sample
c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe
Resource
win10-en-20211208
General
-
Target
c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe
-
Size
334KB
-
MD5
9cea3b2c71e8d487e8979b280beb71d3
-
SHA1
18fdf98f9f3f0a1adaabc7e386650c40fe6c7798
-
SHA256
c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c
-
SHA512
9e23e04fdeb51613d579bd215946828d80ade48c5f2dede80aaac3ff60c47d1345fd56e443497ac60fc57b790eaab502423d6c230864bf586d2dd32fa3955ab4
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2896 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exedescription pid process target process PID 492 set thread context of 1632 492 c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exepid process 1632 c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe 1632 c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2896 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exepid process 1632 c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exedescription pid process target process PID 492 wrote to memory of 1632 492 c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe PID 492 wrote to memory of 1632 492 c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe PID 492 wrote to memory of 1632 492 c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe PID 492 wrote to memory of 1632 492 c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe PID 492 wrote to memory of 1632 492 c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe PID 492 wrote to memory of 1632 492 c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe"C:\Users\Admin\AppData\Local\Temp\c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe"C:\Users\Admin\AppData\Local\Temp\c2b034d48cf58fea7fd187f265cbf28039fc7dbe3499dbd766bbbca7b4a1bc4c.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/492-115-0x0000000000820000-0x000000000084A000-memory.dmpFilesize
168KB
-
memory/492-116-0x00000000005E0000-0x00000000005E9000-memory.dmpFilesize
36KB
-
memory/1632-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1632-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2896-119-0x0000000000A40000-0x0000000000A56000-memory.dmpFilesize
88KB