Analysis
-
max time kernel
152s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 14:15
Static task
static1
Behavioral task
behavioral1
Sample
246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe
Resource
win10-en-20211208
General
-
Target
246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe
-
Size
191KB
-
MD5
7a85143966396b917c9e48362c0ef3f1
-
SHA1
0b95a780f364c90647cb232c550048355e69db4e
-
SHA256
246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a
-
SHA512
a8f1c781c484d434ded4b43d53328ccf18eb55dd1d6c4895c91c04df54af636fda8307accd95f8a1c8ab63221f9bb7d55cf5943516e38f335e2a3d98a196848a
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1880 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exedescription pid process target process PID 2384 set thread context of 2736 2384 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exepid process 2736 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe 2736 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1880 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exepid process 2736 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exedescription pid process target process PID 2384 wrote to memory of 2736 2384 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe PID 2384 wrote to memory of 2736 2384 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe PID 2384 wrote to memory of 2736 2384 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe PID 2384 wrote to memory of 2736 2384 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe PID 2384 wrote to memory of 2736 2384 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe PID 2384 wrote to memory of 2736 2384 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe 246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe"C:\Users\Admin\AppData\Local\Temp\246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe"C:\Users\Admin\AppData\Local\Temp\246813b6942879538a89ef006903291d398520c6ecb9ff4f132652740c1ccd1a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1880-122-0x0000000000650000-0x0000000000666000-memory.dmpFilesize
88KB
-
memory/2384-118-0x0000000000590000-0x00000000005B4000-memory.dmpFilesize
144KB
-
memory/2384-120-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/2736-119-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2736-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB