Analysis
-
max time kernel
151s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 07:34
Static task
static1
Behavioral task
behavioral1
Sample
582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe
Resource
win10-en-20211208
General
-
Target
582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe
-
Size
334KB
-
MD5
c4bdff2e28c800fbe751f8abe9d76d04
-
SHA1
775d2ef72a9115b48ab48112ba72460fcae751d6
-
SHA256
582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed
-
SHA512
6aa916849fdfc6df5508f75793b5c417d267fd7792dc78bf217c2a99a4a55e57cab41cb2c7436bee3f70b8623c59a31c3ecce080e59019159bf17c7f09a23023
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3064 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exedescription pid process target process PID 3928 set thread context of 312 3928 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exepid process 312 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe 312 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3064 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exepid process 312 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exedescription pid process target process PID 3928 wrote to memory of 312 3928 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe PID 3928 wrote to memory of 312 3928 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe PID 3928 wrote to memory of 312 3928 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe PID 3928 wrote to memory of 312 3928 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe PID 3928 wrote to memory of 312 3928 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe PID 3928 wrote to memory of 312 3928 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe 582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe"C:\Users\Admin\AppData\Local\Temp\582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe"C:\Users\Admin\AppData\Local\Temp\582a90f93b03471a18f9c2392505c80d352d6dfbabb6b6c2dbf9a50a998022ed.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/312-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/312-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3064-119-0x0000000000CF0000-0x0000000000D06000-memory.dmpFilesize
88KB
-
memory/3928-116-0x0000000002050000-0x0000000002059000-memory.dmpFilesize
36KB