Analysis
-
max time kernel
153s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 15:48
Static task
static1
Behavioral task
behavioral1
Sample
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe
Resource
win10-en-20211208
General
-
Target
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe
-
Size
312KB
-
MD5
6ae0d6efc218e9c89545872d79264bad
-
SHA1
26cc0c343d8f46bb4f526952cfd954d89fc41021
-
SHA256
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09
-
SHA512
e6a9b8bafa000ef3b8f58b6684a4381de03f066206835bee0857c575800d39794e6af0b77c945eba17d1c3096c05f836d69f6357bd8664728408f21f6af125da
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
sthhsdesthhsdepid process 3180 sthhsde 3776 sthhsde -
Deletes itself 1 IoCs
Processes:
pid process 1876 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exesthhsdedescription pid process target process PID 3620 set thread context of 4012 3620 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 3180 set thread context of 3776 3180 sthhsde sthhsde -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exesthhsdedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sthhsde Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sthhsde Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sthhsde -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exepid process 4012 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 4012 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exesthhsdepid process 4012 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 3776 sthhsde -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1876 Token: SeCreatePagefilePrivilege 1876 Token: SeShutdownPrivilege 1876 Token: SeCreatePagefilePrivilege 1876 Token: SeShutdownPrivilege 1876 Token: SeCreatePagefilePrivilege 1876 Token: SeShutdownPrivilege 1876 Token: SeCreatePagefilePrivilege 1876 Token: SeShutdownPrivilege 1876 Token: SeCreatePagefilePrivilege 1876 Token: SeShutdownPrivilege 1876 Token: SeCreatePagefilePrivilege 1876 Token: SeShutdownPrivilege 1876 Token: SeCreatePagefilePrivilege 1876 Token: SeShutdownPrivilege 1876 Token: SeCreatePagefilePrivilege 1876 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exesthhsdedescription pid process target process PID 3620 wrote to memory of 4012 3620 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 3620 wrote to memory of 4012 3620 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 3620 wrote to memory of 4012 3620 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 3620 wrote to memory of 4012 3620 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 3620 wrote to memory of 4012 3620 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 3620 wrote to memory of 4012 3620 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe 001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe PID 3180 wrote to memory of 3776 3180 sthhsde sthhsde PID 3180 wrote to memory of 3776 3180 sthhsde sthhsde PID 3180 wrote to memory of 3776 3180 sthhsde sthhsde PID 3180 wrote to memory of 3776 3180 sthhsde sthhsde PID 3180 wrote to memory of 3776 3180 sthhsde sthhsde PID 3180 wrote to memory of 3776 3180 sthhsde sthhsde
Processes
-
C:\Users\Admin\AppData\Local\Temp\001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe"C:\Users\Admin\AppData\Local\Temp\001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe"C:\Users\Admin\AppData\Local\Temp\001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\sthhsdeC:\Users\Admin\AppData\Roaming\sthhsde1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\sthhsdeC:\Users\Admin\AppData\Roaming\sthhsde2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\sthhsdeMD5
6ae0d6efc218e9c89545872d79264bad
SHA126cc0c343d8f46bb4f526952cfd954d89fc41021
SHA256001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09
SHA512e6a9b8bafa000ef3b8f58b6684a4381de03f066206835bee0857c575800d39794e6af0b77c945eba17d1c3096c05f836d69f6357bd8664728408f21f6af125da
-
C:\Users\Admin\AppData\Roaming\sthhsdeMD5
6ae0d6efc218e9c89545872d79264bad
SHA126cc0c343d8f46bb4f526952cfd954d89fc41021
SHA256001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09
SHA512e6a9b8bafa000ef3b8f58b6684a4381de03f066206835bee0857c575800d39794e6af0b77c945eba17d1c3096c05f836d69f6357bd8664728408f21f6af125da
-
C:\Users\Admin\AppData\Roaming\sthhsdeMD5
6ae0d6efc218e9c89545872d79264bad
SHA126cc0c343d8f46bb4f526952cfd954d89fc41021
SHA256001ed2083408002a0bc62382caab167977daad2753cd89cb63886bc786a03e09
SHA512e6a9b8bafa000ef3b8f58b6684a4381de03f066206835bee0857c575800d39794e6af0b77c945eba17d1c3096c05f836d69f6357bd8664728408f21f6af125da
-
memory/1876-119-0x00000000013F0000-0x0000000001406000-memory.dmpFilesize
88KB
-
memory/1876-126-0x0000000001560000-0x0000000001576000-memory.dmpFilesize
88KB
-
memory/3180-122-0x00000000008A0000-0x00000000008C4000-memory.dmpFilesize
144KB
-
memory/3620-115-0x00000000007A0000-0x00000000007C4000-memory.dmpFilesize
144KB
-
memory/3620-116-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3776-125-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4012-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4012-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB