Analysis
-
max time kernel
153s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 10:55
Static task
static1
Behavioral task
behavioral1
Sample
a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe
Resource
win10-en-20211208
General
-
Target
a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe
-
Size
191KB
-
MD5
bf3c15a23da8ada2ea27323438f72236
-
SHA1
2ba5b39c5ceb04bf3414b34d35da6863903c18d3
-
SHA256
a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e
-
SHA512
2b530bd3c6811981788dfd7d8fc4a62ab98ed6c7a95053bfb3b05e8f4372e1a467128fc52cdea21bdb144052a3808459af452ddbdea34183fe3e0bdc3b00fa41
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2892 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exedescription pid process target process PID 2756 set thread context of 3452 2756 a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exepid process 3452 a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe 3452 a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2892 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exepid process 3452 a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exedescription pid process target process PID 2756 wrote to memory of 3452 2756 a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe PID 2756 wrote to memory of 3452 2756 a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe PID 2756 wrote to memory of 3452 2756 a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe PID 2756 wrote to memory of 3452 2756 a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe PID 2756 wrote to memory of 3452 2756 a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe PID 2756 wrote to memory of 3452 2756 a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe"C:\Users\Admin\AppData\Local\Temp\a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe"C:\Users\Admin\AppData\Local\Temp\a41b43752216eb816f7474c6790a03c1abbc56658581fe6578c849a758775b0e.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2756-115-0x00000000007D0000-0x00000000007F4000-memory.dmpFilesize
144KB
-
memory/2756-116-0x00000000005A0000-0x00000000005A9000-memory.dmpFilesize
36KB
-
memory/2892-119-0x00000000013C0000-0x00000000013D6000-memory.dmpFilesize
88KB
-
memory/3452-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3452-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB