Analysis
-
max time kernel
155s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 10:19
Static task
static1
Behavioral task
behavioral1
Sample
6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe
Resource
win10-en-20211208
General
-
Target
6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe
-
Size
333KB
-
MD5
76efe41ec633ff854952addfe63507ab
-
SHA1
ea7d43dd420cf81d6a63274564fdb99bde5adb32
-
SHA256
6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782
-
SHA512
87341c82ee3ec3b6f33a52cbb342554f669c225a12333980f74232fb02cc76116776f8bbd28db244be63b3ee2fc01dc720222e9d1d388948c88213842e28681f
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3036 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exedescription pid process target process PID 2680 set thread context of 3488 2680 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exepid process 3488 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe 3488 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3036 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exepid process 3488 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exedescription pid process target process PID 2680 wrote to memory of 3488 2680 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe PID 2680 wrote to memory of 3488 2680 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe PID 2680 wrote to memory of 3488 2680 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe PID 2680 wrote to memory of 3488 2680 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe PID 2680 wrote to memory of 3488 2680 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe PID 2680 wrote to memory of 3488 2680 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe 6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe"C:\Users\Admin\AppData\Local\Temp\6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe"C:\Users\Admin\AppData\Local\Temp\6379113636f21c7eecfdda9ab8fb0e661a6bfdce3186272cbfe17e185c984782.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2680-115-0x00000000006B0000-0x00000000006DA000-memory.dmpFilesize
168KB
-
memory/2680-116-0x0000000002190000-0x0000000002199000-memory.dmpFilesize
36KB
-
memory/3036-119-0x0000000000680000-0x0000000000696000-memory.dmpFilesize
88KB
-
memory/3488-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3488-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB