Analysis
-
max time kernel
159s -
max time network
138s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 01:30
Static task
static1
Behavioral task
behavioral1
Sample
07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe
Resource
win10-en-20211208
General
-
Target
07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe
-
Size
240KB
-
MD5
e340f9d46388591e62193c895c265f7d
-
SHA1
3ad2bf617090413133cb82044bbc9b4199836746
-
SHA256
07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048
-
SHA512
d3833a399dee1882b814570c812585855f6cd5ffb0fa3d51eef54f72c4a98210785c859ca39ce9145fd882aecdad0cd6493963726975b57f44905d14f1b7b7d1
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3040 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exedescription pid process target process PID 2620 set thread context of 3796 2620 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exepid process 3796 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe 3796 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3040 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exepid process 3796 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exedescription pid process target process PID 2620 wrote to memory of 3796 2620 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe PID 2620 wrote to memory of 3796 2620 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe PID 2620 wrote to memory of 3796 2620 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe PID 2620 wrote to memory of 3796 2620 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe PID 2620 wrote to memory of 3796 2620 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe PID 2620 wrote to memory of 3796 2620 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe 07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe"C:\Users\Admin\AppData\Local\Temp\07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe"C:\Users\Admin\AppData\Local\Temp\07da30e4f884ecbd93bb96b537173343c418e51e027fb939a3ebf2646153c048.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2620-115-0x00000000004FA000-0x0000000000503000-memory.dmpFilesize
36KB
-
memory/2620-117-0x00000000001D0000-0x00000000001D9000-memory.dmpFilesize
36KB
-
memory/3040-119-0x0000000000DC0000-0x0000000000DD6000-memory.dmpFilesize
88KB
-
memory/3796-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3796-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB