Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 09:45
Static task
static1
Behavioral task
behavioral1
Sample
d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe
Resource
win10-en-20211208
General
-
Target
d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe
-
Size
334KB
-
MD5
2cfc1d9979604a809fbc53637c3cc529
-
SHA1
887f45bfa3958b9560365797ddf3e53d605a5aad
-
SHA256
d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653
-
SHA512
4b3fe5c4d85d5417f7d5685f15e2188f8864f9dd231c0ae5e487bc26001bd4a78e725137cbd8b1aaa8ba7c43d397a375b4d58c63d83676eac8aca104cbfe835e
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2984 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exedescription pid process target process PID 3260 set thread context of 4076 3260 d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exepid process 4076 d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe 4076 d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2984 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exepid process 4076 d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exedescription pid process target process PID 3260 wrote to memory of 4076 3260 d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe PID 3260 wrote to memory of 4076 3260 d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe PID 3260 wrote to memory of 4076 3260 d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe PID 3260 wrote to memory of 4076 3260 d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe PID 3260 wrote to memory of 4076 3260 d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe PID 3260 wrote to memory of 4076 3260 d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe"C:\Users\Admin\AppData\Local\Temp\d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe"C:\Users\Admin\AppData\Local\Temp\d0a94eee3062489f74722558e7dd98518a7efb45dc0aa4ba4a961b4076eb9653.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2984-119-0x0000000000A00000-0x0000000000A16000-memory.dmpFilesize
88KB
-
memory/3260-115-0x00000000005D8000-0x00000000005E8000-memory.dmpFilesize
64KB
-
memory/3260-117-0x0000000000510000-0x0000000000519000-memory.dmpFilesize
36KB
-
memory/4076-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4076-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB