Analysis
-
max time kernel
171s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
27-01-2022 16:15
Static task
static1
Behavioral task
behavioral1
Sample
f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe
Resource
win10v2004-en-20220112
General
-
Target
f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe
-
Size
190KB
-
MD5
ccef5c71b280ae29fb27efa5dfccc214
-
SHA1
3864d99bc362d1b7b01f4814d783923face75a50
-
SHA256
f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a
-
SHA512
1e4e5170735c3aa45f608f4c3bb7f56bcecc0b5b7eb20ceed53fe3414b54efd276329fe6bf72e97aca3652a6a403e9870a8c5e25887d84b44001f15d4ec70eb0
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
awjuvsaawjuvsapid process 3028 awjuvsa 992 awjuvsa -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exeawjuvsadescription pid process target process PID 1748 set thread context of 3280 1748 f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe PID 3028 set thread context of 992 3028 awjuvsa awjuvsa -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exeawjuvsadescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI awjuvsa Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI awjuvsa Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI awjuvsa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exepid process 3280 f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe 3280 f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2440 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exeawjuvsapid process 3280 f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe 992 awjuvsa -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2440 Token: SeCreatePagefilePrivilege 2440 Token: SeShutdownPrivilege 2440 Token: SeCreatePagefilePrivilege 2440 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exeawjuvsadescription pid process target process PID 1748 wrote to memory of 3280 1748 f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe PID 1748 wrote to memory of 3280 1748 f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe PID 1748 wrote to memory of 3280 1748 f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe PID 1748 wrote to memory of 3280 1748 f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe PID 1748 wrote to memory of 3280 1748 f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe PID 1748 wrote to memory of 3280 1748 f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe PID 3028 wrote to memory of 992 3028 awjuvsa awjuvsa PID 3028 wrote to memory of 992 3028 awjuvsa awjuvsa PID 3028 wrote to memory of 992 3028 awjuvsa awjuvsa PID 3028 wrote to memory of 992 3028 awjuvsa awjuvsa PID 3028 wrote to memory of 992 3028 awjuvsa awjuvsa PID 3028 wrote to memory of 992 3028 awjuvsa awjuvsa
Processes
-
C:\Users\Admin\AppData\Local\Temp\f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe"C:\Users\Admin\AppData\Local\Temp\f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe"C:\Users\Admin\AppData\Local\Temp\f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 7bce756b652f8fd8243c2eea27993836 Mes2Tn/r9kiM1Vv+Mn0a5A.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Roaming\awjuvsaC:\Users\Admin\AppData\Roaming\awjuvsa1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\awjuvsaC:\Users\Admin\AppData\Roaming\awjuvsa2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\awjuvsaMD5
ccef5c71b280ae29fb27efa5dfccc214
SHA13864d99bc362d1b7b01f4814d783923face75a50
SHA256f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a
SHA5121e4e5170735c3aa45f608f4c3bb7f56bcecc0b5b7eb20ceed53fe3414b54efd276329fe6bf72e97aca3652a6a403e9870a8c5e25887d84b44001f15d4ec70eb0
-
C:\Users\Admin\AppData\Roaming\awjuvsaMD5
ccef5c71b280ae29fb27efa5dfccc214
SHA13864d99bc362d1b7b01f4814d783923face75a50
SHA256f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a
SHA5121e4e5170735c3aa45f608f4c3bb7f56bcecc0b5b7eb20ceed53fe3414b54efd276329fe6bf72e97aca3652a6a403e9870a8c5e25887d84b44001f15d4ec70eb0
-
C:\Users\Admin\AppData\Roaming\awjuvsaMD5
ccef5c71b280ae29fb27efa5dfccc214
SHA13864d99bc362d1b7b01f4814d783923face75a50
SHA256f27deb3a24aaab38246363f17b387115493118b13fa547ed7610ef7f883b8b0a
SHA5121e4e5170735c3aa45f608f4c3bb7f56bcecc0b5b7eb20ceed53fe3414b54efd276329fe6bf72e97aca3652a6a403e9870a8c5e25887d84b44001f15d4ec70eb0
-
memory/1748-130-0x00000000007B0000-0x00000000007D9000-memory.dmpFilesize
164KB
-
memory/1748-131-0x00000000005C0000-0x00000000005C9000-memory.dmpFilesize
36KB
-
memory/2440-134-0x00000000031D0000-0x00000000031E6000-memory.dmpFilesize
88KB
-
memory/2440-140-0x0000000003420000-0x0000000003436000-memory.dmpFilesize
88KB
-
memory/3028-137-0x00000000007A0000-0x00000000007C7000-memory.dmpFilesize
156KB
-
memory/3280-132-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3280-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB