Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 02:42
Static task
static1
Behavioral task
behavioral1
Sample
0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe
Resource
win10-en-20211208
General
-
Target
0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe
-
Size
240KB
-
MD5
fd4f1ec06d0375df6624154198c0137b
-
SHA1
44395c4c0b7a2c331e8b627aac8596f556db88d8
-
SHA256
0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa
-
SHA512
dc352691113be7c2f28127cbe9b59c087ff5b87eb2c5e204b706af2a65dd28a6301a13d7241cd5c39ee1df494ef3b3514476c6a643cebdb8c5dc1184eb30fe5f
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3036 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exedescription pid process target process PID 3184 set thread context of 3308 3184 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exepid process 3308 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe 3308 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3036 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exepid process 3308 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exedescription pid process target process PID 3184 wrote to memory of 3308 3184 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe PID 3184 wrote to memory of 3308 3184 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe PID 3184 wrote to memory of 3308 3184 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe PID 3184 wrote to memory of 3308 3184 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe PID 3184 wrote to memory of 3308 3184 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe PID 3184 wrote to memory of 3308 3184 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe 0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe"C:\Users\Admin\AppData\Local\Temp\0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe"C:\Users\Admin\AppData\Local\Temp\0926c4d0c982356201190f26adb94fa374206b299cb889c146872380158507fa.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3036-118-0x0000000000A30000-0x0000000000A46000-memory.dmpFilesize
88KB
-
memory/3184-115-0x0000000000450000-0x00000000004FE000-memory.dmpFilesize
696KB
-
memory/3308-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3308-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB