Analysis
-
max time kernel
152s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
27-01-2022 17:15
Static task
static1
Behavioral task
behavioral1
Sample
917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe
Resource
win10v2004-en-20220112
General
-
Target
917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe
-
Size
189KB
-
MD5
874452dbe27bfca41ffd22ca8ddc1c4e
-
SHA1
3840a51c89928deaec77100be44bd15e788a0a68
-
SHA256
917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf
-
SHA512
a8c50cd254ac0fade53c54ce2853ab4504567d3d14e08fb9c68ebeec1defa0ae65e7aa82436334277aa49e2c1c133407543d9b873a84359fb6bca6aa2226c8b3
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exedescription pid process target process PID 4056 set thread context of 1764 4056 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exepid process 1764 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe 1764 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2488 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exepid process 1764 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2488 Token: SeCreatePagefilePrivilege 2488 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exedescription pid process target process PID 4056 wrote to memory of 1764 4056 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe PID 4056 wrote to memory of 1764 4056 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe PID 4056 wrote to memory of 1764 4056 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe PID 4056 wrote to memory of 1764 4056 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe PID 4056 wrote to memory of 1764 4056 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe PID 4056 wrote to memory of 1764 4056 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe 917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe"C:\Users\Admin\AppData\Local\Temp\917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe"C:\Users\Admin\AppData\Local\Temp\917d9b49f0f74337ef54a15a640ba5bdd996d4ce6cc1ab9520b96eeb940eaebf.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 930bec5fd53a0eb628e9835539fda750 GR0me9U24E+ri1QlgabnZA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1764-131-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1764-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2488-134-0x0000000002720000-0x0000000002736000-memory.dmpFilesize
88KB
-
memory/4056-130-0x0000000000570000-0x0000000000598000-memory.dmpFilesize
160KB
-
memory/4056-132-0x0000000002170000-0x0000000002179000-memory.dmpFilesize
36KB