Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 20:32
Static task
static1
Behavioral task
behavioral1
Sample
6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe
Resource
win10-en-20211208
General
-
Target
6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe
-
Size
355KB
-
MD5
c74bfb8c42b9bc19df7188855801ba3b
-
SHA1
f9381a02df0166e7682f4228ce79cbd1c2b386b0
-
SHA256
6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380
-
SHA512
3026bc806fe5805e76f4cd1f81aa5ba73d1421c0d371bcc640534e12cdfaedd06bfd27cf34ea0874260a608688b87aa8036e59a4f31772f2c206d3593b32eba3
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 396 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exedescription pid process target process PID 3780 set thread context of 4132 3780 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exepid process 4132 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe 4132 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 396 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exepid process 4132 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exedescription pid process target process PID 3780 wrote to memory of 4132 3780 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe PID 3780 wrote to memory of 4132 3780 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe PID 3780 wrote to memory of 4132 3780 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe PID 3780 wrote to memory of 4132 3780 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe PID 3780 wrote to memory of 4132 3780 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe PID 3780 wrote to memory of 4132 3780 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe 6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe"C:\Users\Admin\AppData\Local\Temp\6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe"C:\Users\Admin\AppData\Local\Temp\6eeff51fd91cec8bf83db081595d25cb79fca0efccf1ef954b53f7bf23bf9380.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-118-0x0000000000B20000-0x0000000000B36000-memory.dmpFilesize
88KB
-
memory/3780-116-0x00000000005B0000-0x00000000005B9000-memory.dmpFilesize
36KB
-
memory/4132-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4132-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB