Analysis
-
max time kernel
155s -
max time network
159s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 23:53
Static task
static1
Behavioral task
behavioral1
Sample
ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe
Resource
win10-en-20211208
General
-
Target
ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe
-
Size
352KB
-
MD5
4b4a446e64e4da009403d32278941ed0
-
SHA1
c161d17a341fc95cd8cbe3eb7abe3e654239a27d
-
SHA256
ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170
-
SHA512
cb73611376606edbf26ccc2643c9785edbe1fd01211880f439f3f1eae002f7d5ca084e70e3fc7b415ea9dd0c5ff53da333c8d5e820ef4db156de1403e31cbe06
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3024 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exedescription pid process target process PID 2428 set thread context of 3708 2428 ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exepid process 3708 ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe 3708 ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3024 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exepid process 3708 ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exedescription pid process target process PID 2428 wrote to memory of 3708 2428 ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe PID 2428 wrote to memory of 3708 2428 ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe PID 2428 wrote to memory of 3708 2428 ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe PID 2428 wrote to memory of 3708 2428 ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe PID 2428 wrote to memory of 3708 2428 ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe PID 2428 wrote to memory of 3708 2428 ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe"C:\Users\Admin\AppData\Local\Temp\ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe"C:\Users\Admin\AppData\Local\Temp\ef1c89a25c0414f41694bd95318370df3fe7e0428c1725a2b1c719eaec759170.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2428-119-0x0000000000520000-0x0000000000529000-memory.dmpFilesize
36KB
-
memory/3024-122-0x00000000012D0000-0x00000000012E6000-memory.dmpFilesize
88KB
-
memory/3708-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3708-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB