Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 04:20
Static task
static1
Behavioral task
behavioral1
Sample
f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe
Resource
win10-en-20211208
General
-
Target
f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe
-
Size
240KB
-
MD5
0de7c1706948ef17478a6b96533e4b20
-
SHA1
5a267116c7468b8c749be16a7f017b9877311ea9
-
SHA256
f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83
-
SHA512
3f10c05361a2e816ecd489a3b86cabbae1bbb860dcce9e20360853601a48bf4297ca00d211f2f241542e8694ae3d77d54c65ae6d4face137f3c487cbe75088b5
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2712 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exedescription pid process target process PID 3972 set thread context of 1136 3972 f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exepid process 1136 f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe 1136 f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2712 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exepid process 1136 f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exedescription pid process target process PID 3972 wrote to memory of 1136 3972 f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe PID 3972 wrote to memory of 1136 3972 f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe PID 3972 wrote to memory of 1136 3972 f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe PID 3972 wrote to memory of 1136 3972 f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe PID 3972 wrote to memory of 1136 3972 f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe PID 3972 wrote to memory of 1136 3972 f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe"C:\Users\Admin\AppData\Local\Temp\f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe"C:\Users\Admin\AppData\Local\Temp\f642c0fd4c7baf7bdecfa0a0a3ba59f2b1ec6669c3f8d080276cab08b952af83.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1136-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1136-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2712-119-0x0000000000720000-0x0000000000736000-memory.dmpFilesize
88KB
-
memory/3972-117-0x00000000004A0000-0x00000000004A9000-memory.dmpFilesize
36KB