Analysis
-
max time kernel
168s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
27-01-2022 02:56
Static task
static1
Behavioral task
behavioral1
Sample
929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe
Resource
win10v2004-en-20220112
General
-
Target
929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe
-
Size
241KB
-
MD5
344c34de03ae7b7d62a843cb37dacfd8
-
SHA1
8cc482646cb15c80dd523e951cbab7db2011a29a
-
SHA256
929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a
-
SHA512
ac9373a3145799fb83f161512bb7133fb0b6ad4c0ca4c4e6bd7af5f02a777cbb5fd6dd81c2a2480ca2fd32f7a7c6adda647bcf8b063cf955d21b26801b28beb4
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
cacerahcacerahpid process 3268 cacerah 3916 cacerah -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.execacerahdescription pid process target process PID 224 set thread context of 4000 224 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe PID 3268 set thread context of 3916 3268 cacerah cacerah -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.execacerahdescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cacerah Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cacerah Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cacerah Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exepid process 4000 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe 4000 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2412 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.execacerahpid process 4000 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe 3916 cacerah -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.execacerahdescription pid process target process PID 224 wrote to memory of 4000 224 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe PID 224 wrote to memory of 4000 224 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe PID 224 wrote to memory of 4000 224 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe PID 224 wrote to memory of 4000 224 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe PID 224 wrote to memory of 4000 224 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe PID 224 wrote to memory of 4000 224 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe 929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe PID 3268 wrote to memory of 3916 3268 cacerah cacerah PID 3268 wrote to memory of 3916 3268 cacerah cacerah PID 3268 wrote to memory of 3916 3268 cacerah cacerah PID 3268 wrote to memory of 3916 3268 cacerah cacerah PID 3268 wrote to memory of 3916 3268 cacerah cacerah PID 3268 wrote to memory of 3916 3268 cacerah cacerah
Processes
-
C:\Users\Admin\AppData\Local\Temp\929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe"C:\Users\Admin\AppData\Local\Temp\929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe"C:\Users\Admin\AppData\Local\Temp\929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe a47bb1418f4b8bc9c2e7743d8b2ff45a /fHnhOTCGk2FIQ1skF4/hw.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Roaming\cacerahC:\Users\Admin\AppData\Roaming\cacerah1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cacerahC:\Users\Admin\AppData\Roaming\cacerah2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\cacerahMD5
344c34de03ae7b7d62a843cb37dacfd8
SHA18cc482646cb15c80dd523e951cbab7db2011a29a
SHA256929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a
SHA512ac9373a3145799fb83f161512bb7133fb0b6ad4c0ca4c4e6bd7af5f02a777cbb5fd6dd81c2a2480ca2fd32f7a7c6adda647bcf8b063cf955d21b26801b28beb4
-
C:\Users\Admin\AppData\Roaming\cacerahMD5
344c34de03ae7b7d62a843cb37dacfd8
SHA18cc482646cb15c80dd523e951cbab7db2011a29a
SHA256929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a
SHA512ac9373a3145799fb83f161512bb7133fb0b6ad4c0ca4c4e6bd7af5f02a777cbb5fd6dd81c2a2480ca2fd32f7a7c6adda647bcf8b063cf955d21b26801b28beb4
-
C:\Users\Admin\AppData\Roaming\cacerahMD5
344c34de03ae7b7d62a843cb37dacfd8
SHA18cc482646cb15c80dd523e951cbab7db2011a29a
SHA256929b92219b383421ceb8ed1dca526906e377483572655a854b0b8bc56798688a
SHA512ac9373a3145799fb83f161512bb7133fb0b6ad4c0ca4c4e6bd7af5f02a777cbb5fd6dd81c2a2480ca2fd32f7a7c6adda647bcf8b063cf955d21b26801b28beb4
-
memory/224-133-0x0000000000710000-0x0000000000739000-memory.dmpFilesize
164KB
-
memory/224-134-0x00000000006E0000-0x00000000006E9000-memory.dmpFilesize
36KB
-
memory/2412-137-0x0000000000C30000-0x0000000000C46000-memory.dmpFilesize
88KB
-
memory/2412-144-0x0000000000C50000-0x0000000000C66000-memory.dmpFilesize
88KB
-
memory/3268-140-0x0000000000540000-0x0000000000568000-memory.dmpFilesize
160KB
-
memory/3916-143-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4000-135-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4000-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB