Analysis
-
max time kernel
151s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 07:47
Static task
static1
Behavioral task
behavioral1
Sample
fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe
Resource
win10-en-20211208
General
-
Target
fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe
-
Size
333KB
-
MD5
72c8e80ecc45fb13690ab3b896bb863e
-
SHA1
1d042e52aa1fe230533ec7436f2761e1d4838989
-
SHA256
fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0
-
SHA512
1596cf6011c2665849ffa580d4477d403cf4fdd6ff683fdb3d22b95aceb309de37561a9fcba4675af1749bf907d55b334abc4f9729105416c32495428071c8f4
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2072 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exedescription pid process target process PID 3780 set thread context of 3440 3780 fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exepid process 3440 fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe 3440 fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2072 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exepid process 3440 fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exedescription pid process target process PID 3780 wrote to memory of 3440 3780 fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe PID 3780 wrote to memory of 3440 3780 fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe PID 3780 wrote to memory of 3440 3780 fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe PID 3780 wrote to memory of 3440 3780 fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe PID 3780 wrote to memory of 3440 3780 fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe PID 3780 wrote to memory of 3440 3780 fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe"C:\Users\Admin\AppData\Local\Temp\fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe"C:\Users\Admin\AppData\Local\Temp\fe95c41e92f1497ba046f003a5de0553d2bf87d5544120ebeec23311f8c7f8e0.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2072-119-0x0000000000DF0000-0x0000000000E06000-memory.dmpFilesize
88KB
-
memory/3440-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3440-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3780-115-0x0000000000660000-0x0000000000689000-memory.dmpFilesize
164KB
-
memory/3780-116-0x0000000000480000-0x00000000005CA000-memory.dmpFilesize
1.3MB