Analysis
-
max time kernel
164s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 04:40
Static task
static1
Behavioral task
behavioral1
Sample
798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe
Resource
win10-en-20211208
General
-
Target
798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe
-
Size
240KB
-
MD5
49f0abdf9938b07ee4d8ef39c88a6619
-
SHA1
18d9b0bc5b27b048302baf0ef362dd896843970c
-
SHA256
798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11
-
SHA512
2905a695f52e8ffa8b33ad5c4ba2d5d6ba6caea13f92eb1983d1a6092b36a1dcf6f50b724101e6c02a1b6b9a454622796f048a10a96d94cbc3f54a71ad7c2d4c
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3048 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exedescription pid process target process PID 2256 set thread context of 3184 2256 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exepid process 3184 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe 3184 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3048 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exepid process 3184 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exedescription pid process target process PID 2256 wrote to memory of 3184 2256 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe PID 2256 wrote to memory of 3184 2256 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe PID 2256 wrote to memory of 3184 2256 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe PID 2256 wrote to memory of 3184 2256 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe PID 2256 wrote to memory of 3184 2256 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe PID 2256 wrote to memory of 3184 2256 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe 798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe"C:\Users\Admin\AppData\Local\Temp\798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe"C:\Users\Admin\AppData\Local\Temp\798a6d562fb64437db70a86d734f31833fdd4b1b89cd1f15c795657b3126dd11.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2256-117-0x0000000000750000-0x0000000000774000-memory.dmpFilesize
144KB
-
memory/2256-119-0x0000000000450000-0x000000000059A000-memory.dmpFilesize
1.3MB
-
memory/3048-121-0x0000000001580000-0x0000000001596000-memory.dmpFilesize
88KB
-
memory/3184-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3184-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB