Analysis
-
max time kernel
158s -
max time network
129s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 21:02
Static task
static1
Behavioral task
behavioral1
Sample
ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe
Resource
win10-en-20211208
General
-
Target
ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe
-
Size
190KB
-
MD5
1acbff9c58cf59805ad4b72ae2fe392f
-
SHA1
187281ef004cc6aeb3353e9d208ab0deb6837585
-
SHA256
ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb
-
SHA512
6cb2601d2b74d5da89b321c133a5888e9d90e6545c72b3f088e070c509d94de3f5b665522fce7accb03d38d71f8ce21494bd1812922f391b15dd7ba8a2eb94b1
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3040 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exedescription pid process target process PID 2836 set thread context of 4084 2836 ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exepid process 4084 ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe 4084 ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3040 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exepid process 4084 ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exedescription pid process target process PID 2836 wrote to memory of 4084 2836 ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe PID 2836 wrote to memory of 4084 2836 ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe PID 2836 wrote to memory of 4084 2836 ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe PID 2836 wrote to memory of 4084 2836 ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe PID 2836 wrote to memory of 4084 2836 ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe PID 2836 wrote to memory of 4084 2836 ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe"C:\Users\Admin\AppData\Local\Temp\ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe"C:\Users\Admin\AppData\Local\Temp\ecbcdb0c66051f5c421f8f2b1d66130b4b5d2d2c6e7b927e0ef6e2f20ce2c1eb.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2836-118-0x00000000006D0000-0x00000000006F4000-memory.dmpFilesize
144KB
-
memory/2836-119-0x00000000006B0000-0x00000000006B9000-memory.dmpFilesize
36KB
-
memory/3040-122-0x0000000001460000-0x0000000001476000-memory.dmpFilesize
88KB
-
memory/4084-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4084-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB