smokeloader | e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e

General

Target

e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe
Size

191KB
MD5

d5e355b2f8756fb50215046d9cc8865c
SHA1

edb5b9c917262e62c46ab47570263a87d0fa3ab8
SHA256

e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e
SHA512

c2a3d7889fdd9becc57a294b6904edbbda8d75ca93bd3265b32a893e14e9097dfa12dbcceecf92fc3c4e26408726b9433da10aad43fec740297c429bbd577e5b

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Suspicious use of SetThreadContext 1 IoCs

Processes:

e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe

description	pid	process	target process
PID 2080 set thread context of 3508	2080	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe

pid	process
3508	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe
3508	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384
2384

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2384
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe

pid process

3508 e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe

pid	process
2384

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe

description	pid	process	target process
PID 2080 wrote to memory of 3508	2080	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe
PID 2080 wrote to memory of 3508	2080	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe
PID 2080 wrote to memory of 3508	2080	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe
PID 2080 wrote to memory of 3508	2080	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe
PID 2080 wrote to memory of 3508	2080	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe
PID 2080 wrote to memory of 3508	2080	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe	e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe

C:\Users\Admin\AppData\Local\Temp\e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe
"C:\Users\Admin\AppData\Local\Temp\e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2080

C:\Users\Admin\AppData\Local\Temp\e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe
"C:\Users\Admin\AppData\Local\Temp\e2c230cd0a480df345cf129af0f3fdd985f7a1bbe50bc90b53926e67aebfa15e.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3508

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe ce757b4e1bb99c312791ec98e6ef6b7b lQrIatP0sESqbu2kA5qkfA.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:3228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-132-0x0000000002170000-0x0000000002179000-memory.dmp

Filesize
36KB

Download
memory/2384-134-0x00000000007E0000-0x00000000007F6000-memory.dmp

Filesize
88KB

Download
memory/3508-131-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3508-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads