Analysis
-
max time kernel
171s -
max time network
173s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 23:14
Static task
static1
Behavioral task
behavioral1
Sample
db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe
Resource
win10-en-20211208
General
-
Target
db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe
-
Size
351KB
-
MD5
40b88d55d51d3edeaae9c9d929099a5c
-
SHA1
7a1b825d740e040808e32d4aa5a83c0f6f025bd9
-
SHA256
db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6
-
SHA512
4cf0beb3405ccbcf3694a7fb14637f68b0bfbcc08090637707a5d828e60df763eccc28031965ac5d1fbbfbaeaf964e1228093fc23dd0c8532fb6652038c05d5f
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3032 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exedescription pid process target process PID 2424 set thread context of 2324 2424 db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exepid process 2324 db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe 2324 db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3032 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exepid process 2324 db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exedescription pid process target process PID 2424 wrote to memory of 2324 2424 db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe PID 2424 wrote to memory of 2324 2424 db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe PID 2424 wrote to memory of 2324 2424 db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe PID 2424 wrote to memory of 2324 2424 db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe PID 2424 wrote to memory of 2324 2424 db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe PID 2424 wrote to memory of 2324 2424 db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe"C:\Users\Admin\AppData\Local\Temp\db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe"C:\Users\Admin\AppData\Local\Temp\db2d18edfef43af03a922dbdf69e5dc1d3b0f3f00927b1cdfe5ad7c13d2438d6.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2324-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2324-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2424-118-0x0000000000740000-0x000000000076A000-memory.dmpFilesize
168KB
-
memory/2424-119-0x00000000005B0000-0x00000000005B9000-memory.dmpFilesize
36KB
-
memory/3032-122-0x0000000000ED0000-0x0000000000EE6000-memory.dmpFilesize
88KB