Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 07:14
Static task
static1
Behavioral task
behavioral1
Sample
8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe
Resource
win10-en-20211208
General
-
Target
8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe
-
Size
356KB
-
MD5
b918c19a5fea69952bb273b9c0a13530
-
SHA1
116c6e4bfe5f9d735fde554a6515b3fcd3c9a173
-
SHA256
8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292
-
SHA512
eba56a6712d4d9449ae2ca3f0577af3b907f528c82be57fc58fde0e98eb9988d94d3c55cc20e526826821fec57088b9955fe3c7c67ef5c4787cf9d4485ed92f2
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3056 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exedescription pid process target process PID 2668 set thread context of 524 2668 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exepid process 524 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe 524 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3056 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exepid process 524 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exedescription pid process target process PID 2668 wrote to memory of 524 2668 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe PID 2668 wrote to memory of 524 2668 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe PID 2668 wrote to memory of 524 2668 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe PID 2668 wrote to memory of 524 2668 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe PID 2668 wrote to memory of 524 2668 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe PID 2668 wrote to memory of 524 2668 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe 8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe"C:\Users\Admin\AppData\Local\Temp\8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe"C:\Users\Admin\AppData\Local\Temp\8366589cf500c413059d816563905de4e7cbefdd126b66bb75f2916eca14c292.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/524-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2668-115-0x00000000006B0000-0x00000000006DA000-memory.dmpFilesize
168KB
-
memory/2668-116-0x0000000000520000-0x0000000000529000-memory.dmpFilesize
36KB
-
memory/3056-119-0x0000000000610000-0x0000000000626000-memory.dmpFilesize
88KB