Analysis
-
max time kernel
159s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
27-01-2022 21:02
Static task
static1
Behavioral task
behavioral1
Sample
d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe
Resource
win10v2004-en-20220112
General
-
Target
d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe
-
Size
190KB
-
MD5
ee419e8bb27ea365a290d3c9e3c33e74
-
SHA1
492681db5de609d5e25680500d73ddac84bce1a9
-
SHA256
d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070
-
SHA512
cff89fb444c31aece2755d5edf47f7d478318ce7cdac039902b6b3b289a9e58c0401561d889a6d1d3bff104e204b191398e62af6c14355c8108a5e06402840dd
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exedescription pid process target process PID 1000 set thread context of 1328 1000 d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exepid process 1328 d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe 1328 d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2488 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exepid process 1328 d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2488 Token: SeCreatePagefilePrivilege 2488 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exedescription pid process target process PID 1000 wrote to memory of 1328 1000 d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe PID 1000 wrote to memory of 1328 1000 d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe PID 1000 wrote to memory of 1328 1000 d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe PID 1000 wrote to memory of 1328 1000 d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe PID 1000 wrote to memory of 1328 1000 d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe PID 1000 wrote to memory of 1328 1000 d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe"C:\Users\Admin\AppData\Local\Temp\d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe"C:\Users\Admin\AppData\Local\Temp\d36fe72f6e00ca24d2dc058ba8ce748b085e86ae8c3b90851b99db3af3e36070.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 48f220b62af55dee65c38b434cdee46c FHrP0mqSN0m2aVNZ/L2hQQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1000-130-0x0000000000730000-0x0000000000758000-memory.dmpFilesize
160KB
-
memory/1000-131-0x00000000006D0000-0x00000000006D9000-memory.dmpFilesize
36KB
-
memory/1328-132-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1328-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2488-134-0x0000000002910000-0x0000000002926000-memory.dmpFilesize
88KB