Analysis
-
max time kernel
169s -
max time network
163s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 22:07
Static task
static1
Behavioral task
behavioral1
Sample
a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe
Resource
win10-en-20211208
General
-
Target
a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe
-
Size
352KB
-
MD5
f7e2e5686354978bb89bd5eb73438907
-
SHA1
f457dedf54f6ea5ee05792bdbc71f1d08813e65f
-
SHA256
a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14
-
SHA512
120107374bc01ae19eb05196bedf0093af3ff77f5ab4e32bf81ba753ab8760d159eb5d34df86a23221f595b466b554e5bbb24b1383dcfedc688445c17aee1516
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1876 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exedescription pid process target process PID 3468 set thread context of 4304 3468 a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exepid process 4304 a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe 4304 a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 1876 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1876 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exepid process 4304 a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exedescription pid process target process PID 3468 wrote to memory of 4304 3468 a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe PID 3468 wrote to memory of 4304 3468 a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe PID 3468 wrote to memory of 4304 3468 a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe PID 3468 wrote to memory of 4304 3468 a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe PID 3468 wrote to memory of 4304 3468 a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe PID 3468 wrote to memory of 4304 3468 a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe"C:\Users\Admin\AppData\Local\Temp\a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe"C:\Users\Admin\AppData\Local\Temp\a616f32826d3ad90e66c3334da950ad55fafb43b818f1c3d3137cda3ce4b6c14.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1876-122-0x00000000013F0000-0x0000000001406000-memory.dmpFilesize
88KB
-
memory/3468-119-0x0000000000490000-0x000000000053E000-memory.dmpFilesize
696KB
-
memory/4304-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4304-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB