Analysis
-
max time kernel
154s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 19:01
Static task
static1
Behavioral task
behavioral1
Sample
fc984dab945855a82bd58a4f2b8e6d94.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
fc984dab945855a82bd58a4f2b8e6d94.exe
Resource
win10-en-20211208
General
-
Target
fc984dab945855a82bd58a4f2b8e6d94.exe
-
Size
190KB
-
MD5
fc984dab945855a82bd58a4f2b8e6d94
-
SHA1
b06fd09f7a32c7cd8baf7e291a01d384eafd7542
-
SHA256
30992bd7993a1f698c11d69c5c3e7cf440268cb32e51318e29142f12bd550981
-
SHA512
f237e8de58c341648b8da2ff9483fa893d39592d079f8b702a3c42bfbf06676b3b93e9d0cf65f1b990910c6386a76e2bd22a56306fd473e3c082a9781f9634c3
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1412 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fc984dab945855a82bd58a4f2b8e6d94.exedescription pid process target process PID 1404 set thread context of 784 1404 fc984dab945855a82bd58a4f2b8e6d94.exe fc984dab945855a82bd58a4f2b8e6d94.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
fc984dab945855a82bd58a4f2b8e6d94.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fc984dab945855a82bd58a4f2b8e6d94.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fc984dab945855a82bd58a4f2b8e6d94.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fc984dab945855a82bd58a4f2b8e6d94.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fc984dab945855a82bd58a4f2b8e6d94.exepid process 784 fc984dab945855a82bd58a4f2b8e6d94.exe 784 fc984dab945855a82bd58a4f2b8e6d94.exe 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1412 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
fc984dab945855a82bd58a4f2b8e6d94.exepid process 784 fc984dab945855a82bd58a4f2b8e6d94.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1412 1412 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1412 1412 -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
fc984dab945855a82bd58a4f2b8e6d94.exedescription pid process target process PID 1404 wrote to memory of 784 1404 fc984dab945855a82bd58a4f2b8e6d94.exe fc984dab945855a82bd58a4f2b8e6d94.exe PID 1404 wrote to memory of 784 1404 fc984dab945855a82bd58a4f2b8e6d94.exe fc984dab945855a82bd58a4f2b8e6d94.exe PID 1404 wrote to memory of 784 1404 fc984dab945855a82bd58a4f2b8e6d94.exe fc984dab945855a82bd58a4f2b8e6d94.exe PID 1404 wrote to memory of 784 1404 fc984dab945855a82bd58a4f2b8e6d94.exe fc984dab945855a82bd58a4f2b8e6d94.exe PID 1404 wrote to memory of 784 1404 fc984dab945855a82bd58a4f2b8e6d94.exe fc984dab945855a82bd58a4f2b8e6d94.exe PID 1404 wrote to memory of 784 1404 fc984dab945855a82bd58a4f2b8e6d94.exe fc984dab945855a82bd58a4f2b8e6d94.exe PID 1404 wrote to memory of 784 1404 fc984dab945855a82bd58a4f2b8e6d94.exe fc984dab945855a82bd58a4f2b8e6d94.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc984dab945855a82bd58a4f2b8e6d94.exe"C:\Users\Admin\AppData\Local\Temp\fc984dab945855a82bd58a4f2b8e6d94.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fc984dab945855a82bd58a4f2b8e6d94.exe"C:\Users\Admin\AppData\Local\Temp\fc984dab945855a82bd58a4f2b8e6d94.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/784-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/784-57-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/784-58-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1404-54-0x0000000000590000-0x00000000005B5000-memory.dmpFilesize
148KB
-
memory/1404-55-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1412-59-0x0000000002170000-0x0000000002186000-memory.dmpFilesize
88KB