Analysis
-
max time kernel
162s -
max time network
168s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 23:08
Static task
static1
Behavioral task
behavioral1
Sample
239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe
Resource
win10-en-20211208
General
-
Target
239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe
-
Size
352KB
-
MD5
505203269796430a2783151a7d1c3f8b
-
SHA1
309f6e146d1cf71c55c1a9611197ac4f7623bd60
-
SHA256
239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757
-
SHA512
9ef1711be85ce6f9d7415f872735ddfb78430778a9c3d6f4d8f91a62746475df2cefb18e079ad3c453991e3e97fa45bd71a44d539f757e3288322a020ec70083
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3004 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exedescription pid process target process PID 2440 set thread context of 1200 2440 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exepid process 1200 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe 1200 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3004 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exepid process 1200 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exedescription pid process target process PID 2440 wrote to memory of 1200 2440 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe PID 2440 wrote to memory of 1200 2440 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe PID 2440 wrote to memory of 1200 2440 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe PID 2440 wrote to memory of 1200 2440 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe PID 2440 wrote to memory of 1200 2440 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe PID 2440 wrote to memory of 1200 2440 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe 239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe"C:\Users\Admin\AppData\Local\Temp\239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe"C:\Users\Admin\AppData\Local\Temp\239613cec88f5f95c9e9f4ec5361c95f9b1f3d8f0a75dab35b72c130b8a15757.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1200-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1200-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2440-119-0x00000000005B0000-0x00000000006FA000-memory.dmpFilesize
1.3MB
-
memory/3004-122-0x0000000000DD0000-0x0000000000DE6000-memory.dmpFilesize
88KB