Analysis
-
max time kernel
151s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 20:18
Static task
static1
Behavioral task
behavioral1
Sample
81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe
Resource
win10-en-20211208
General
-
Target
81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe
-
Size
333KB
-
MD5
159c7b103c04e054c8c3c08f5bd663df
-
SHA1
9bca4411aae658e96b4c761ca776d367566f25af
-
SHA256
81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb
-
SHA512
e6c08333ce4b0f45934e25a45f585a903e4c7365de8dae62dc4b3247220a867d08b3ec316743e6102584ed0d2d67e81d0e6c3d66ab2cc17b5c3159916b8872a1
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
thdwitdthdwitdpid process 2176 thdwitd 3180 thdwitd -
Deletes itself 1 IoCs
Processes:
pid process 3000 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exethdwitddescription pid process target process PID 2760 set thread context of 4012 2760 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe PID 2176 set thread context of 3180 2176 thdwitd thdwitd -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
thdwitd81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI thdwitd Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI thdwitd Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI thdwitd -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exepid process 4012 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe 4012 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3000 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exethdwitdpid process 4012 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe 3180 thdwitd -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exethdwitddescription pid process target process PID 2760 wrote to memory of 4012 2760 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe PID 2760 wrote to memory of 4012 2760 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe PID 2760 wrote to memory of 4012 2760 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe PID 2760 wrote to memory of 4012 2760 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe PID 2760 wrote to memory of 4012 2760 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe PID 2760 wrote to memory of 4012 2760 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe 81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe PID 2176 wrote to memory of 3180 2176 thdwitd thdwitd PID 2176 wrote to memory of 3180 2176 thdwitd thdwitd PID 2176 wrote to memory of 3180 2176 thdwitd thdwitd PID 2176 wrote to memory of 3180 2176 thdwitd thdwitd PID 2176 wrote to memory of 3180 2176 thdwitd thdwitd PID 2176 wrote to memory of 3180 2176 thdwitd thdwitd
Processes
-
C:\Users\Admin\AppData\Local\Temp\81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe"C:\Users\Admin\AppData\Local\Temp\81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe"C:\Users\Admin\AppData\Local\Temp\81a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\thdwitdC:\Users\Admin\AppData\Roaming\thdwitd1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\thdwitdC:\Users\Admin\AppData\Roaming\thdwitd2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\thdwitdMD5
159c7b103c04e054c8c3c08f5bd663df
SHA19bca4411aae658e96b4c761ca776d367566f25af
SHA25681a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb
SHA512e6c08333ce4b0f45934e25a45f585a903e4c7365de8dae62dc4b3247220a867d08b3ec316743e6102584ed0d2d67e81d0e6c3d66ab2cc17b5c3159916b8872a1
-
C:\Users\Admin\AppData\Roaming\thdwitdMD5
159c7b103c04e054c8c3c08f5bd663df
SHA19bca4411aae658e96b4c761ca776d367566f25af
SHA25681a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb
SHA512e6c08333ce4b0f45934e25a45f585a903e4c7365de8dae62dc4b3247220a867d08b3ec316743e6102584ed0d2d67e81d0e6c3d66ab2cc17b5c3159916b8872a1
-
C:\Users\Admin\AppData\Roaming\thdwitdMD5
159c7b103c04e054c8c3c08f5bd663df
SHA19bca4411aae658e96b4c761ca776d367566f25af
SHA25681a2ccab7182a85da858ba37093af6b46a376706a4feff089c171128aaf747eb
SHA512e6c08333ce4b0f45934e25a45f585a903e4c7365de8dae62dc4b3247220a867d08b3ec316743e6102584ed0d2d67e81d0e6c3d66ab2cc17b5c3159916b8872a1
-
memory/2760-115-0x0000000000710000-0x000000000073A000-memory.dmpFilesize
168KB
-
memory/2760-117-0x00000000005E0000-0x00000000005E9000-memory.dmpFilesize
36KB
-
memory/3000-119-0x00000000013E0000-0x00000000013F6000-memory.dmpFilesize
88KB
-
memory/3000-126-0x0000000001530000-0x0000000001546000-memory.dmpFilesize
88KB
-
memory/3180-125-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4012-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4012-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB