Analysis
-
max time kernel
170s -
max time network
162s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 22:28
Static task
static1
Behavioral task
behavioral1
Sample
92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe
Resource
win10-en-20211208
General
-
Target
92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe
-
Size
351KB
-
MD5
0cf6948896da4e3021774b369240271a
-
SHA1
8bc18e5ec6655568bc3f0f684ccb033d2e6eeaf9
-
SHA256
92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846
-
SHA512
c8b2d03835d220a9d37adee1e39afb458f14f0c62d642267b469b56c300afa6784fa98e591aa35238911388cba85550b16fac42b11f0a2a537d7c694921b2b8b
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3040 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exedescription pid process target process PID 3796 set thread context of 2960 3796 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exepid process 2960 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe 2960 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3040 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exepid process 2960 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exedescription pid process target process PID 3796 wrote to memory of 2960 3796 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe PID 3796 wrote to memory of 2960 3796 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe PID 3796 wrote to memory of 2960 3796 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe PID 3796 wrote to memory of 2960 3796 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe PID 3796 wrote to memory of 2960 3796 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe PID 3796 wrote to memory of 2960 3796 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe 92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe"C:\Users\Admin\AppData\Local\Temp\92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe"C:\Users\Admin\AppData\Local\Temp\92d0edf352f9cac9f83320bf517e922a63d5228f1d44652c85eb1db8b5b07846.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2960-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2960-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3040-122-0x0000000001450000-0x0000000001466000-memory.dmpFilesize
88KB
-
memory/3796-118-0x0000000000770000-0x0000000000799000-memory.dmpFilesize
164KB
-
memory/3796-119-0x0000000000570000-0x0000000000579000-memory.dmpFilesize
36KB