Analysis
-
max time kernel
151s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
27-01-2022 02:59
Static task
static1
Behavioral task
behavioral1
Sample
fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe
Resource
win10v2004-en-20220112
General
-
Target
fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe
-
Size
241KB
-
MD5
bc95ec1ba3f071be23627c206d4f27b0
-
SHA1
c4ca4784189cd2e98be66b6822111151d3de5de2
-
SHA256
fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413
-
SHA512
19873828c684f8217e9b0b77ae41cfcab9924b4102bc8f50999c8c8b8a8e4130525d0a535b40b209423da48719bf91ed42d7909cd1732044bfc62ab5c726d7e9
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exedescription pid process target process PID 2852 set thread context of 2108 2852 fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exepid process 2108 fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe 2108 fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2540 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exepid process 2108 fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exedescription pid process target process PID 2852 wrote to memory of 2108 2852 fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe PID 2852 wrote to memory of 2108 2852 fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe PID 2852 wrote to memory of 2108 2852 fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe PID 2852 wrote to memory of 2108 2852 fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe PID 2852 wrote to memory of 2108 2852 fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe PID 2852 wrote to memory of 2108 2852 fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe"C:\Users\Admin\AppData\Local\Temp\fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe"C:\Users\Admin\AppData\Local\Temp\fd7c66a318652505d0d786f1ab95239ad0f98c87872971b8e842080f6dda9413.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 7b62f6420935fb5dd31a74723560b45c YorinnXjoUWhdGTRBe0mRA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2108-131-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2108-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2540-134-0x0000000001340000-0x0000000001356000-memory.dmpFilesize
88KB
-
memory/2852-130-0x00000000005B0000-0x00000000005D8000-memory.dmpFilesize
160KB
-
memory/2852-132-0x00000000005A0000-0x00000000005A9000-memory.dmpFilesize
36KB