Analysis
-
max time kernel
175s -
max time network
178s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 06:37
Static task
static1
Behavioral task
behavioral1
Sample
bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe
Resource
win10-en-20211208
General
-
Target
bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe
-
Size
356KB
-
MD5
e3d296124f2da2201fb37de049efc63e
-
SHA1
87488ab791ca1e0a18258551b7c4ac0c7a182e07
-
SHA256
bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7
-
SHA512
696836f7a79022ac191ca19a1ef759949bbeb51ba269bde59ed722d353828ca3f929c521eb1954e583098956736f0e588fa9e4c6e32b1b22966c735319de6ddc
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
gtdcrecgtdcrecpid process 2836 gtdcrec 1280 gtdcrec -
Deletes itself 1 IoCs
Processes:
pid process 3028 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exegtdcrecdescription pid process target process PID 2672 set thread context of 1376 2672 bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe PID 2836 set thread context of 1280 2836 gtdcrec gtdcrec -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exegtdcrecdescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gtdcrec Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gtdcrec Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gtdcrec Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exepid process 1376 bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe 1376 bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3028 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exegtdcrecpid process 1376 bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe 1280 gtdcrec -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exegtdcrecdescription pid process target process PID 2672 wrote to memory of 1376 2672 bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe PID 2672 wrote to memory of 1376 2672 bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe PID 2672 wrote to memory of 1376 2672 bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe PID 2672 wrote to memory of 1376 2672 bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe PID 2672 wrote to memory of 1376 2672 bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe PID 2672 wrote to memory of 1376 2672 bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe PID 2836 wrote to memory of 1280 2836 gtdcrec gtdcrec PID 2836 wrote to memory of 1280 2836 gtdcrec gtdcrec PID 2836 wrote to memory of 1280 2836 gtdcrec gtdcrec PID 2836 wrote to memory of 1280 2836 gtdcrec gtdcrec PID 2836 wrote to memory of 1280 2836 gtdcrec gtdcrec PID 2836 wrote to memory of 1280 2836 gtdcrec gtdcrec
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe"C:\Users\Admin\AppData\Local\Temp\bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe"C:\Users\Admin\AppData\Local\Temp\bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\gtdcrecC:\Users\Admin\AppData\Roaming\gtdcrec1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\gtdcrecC:\Users\Admin\AppData\Roaming\gtdcrec2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\gtdcrecMD5
e3d296124f2da2201fb37de049efc63e
SHA187488ab791ca1e0a18258551b7c4ac0c7a182e07
SHA256bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7
SHA512696836f7a79022ac191ca19a1ef759949bbeb51ba269bde59ed722d353828ca3f929c521eb1954e583098956736f0e588fa9e4c6e32b1b22966c735319de6ddc
-
C:\Users\Admin\AppData\Roaming\gtdcrecMD5
e3d296124f2da2201fb37de049efc63e
SHA187488ab791ca1e0a18258551b7c4ac0c7a182e07
SHA256bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7
SHA512696836f7a79022ac191ca19a1ef759949bbeb51ba269bde59ed722d353828ca3f929c521eb1954e583098956736f0e588fa9e4c6e32b1b22966c735319de6ddc
-
C:\Users\Admin\AppData\Roaming\gtdcrecMD5
e3d296124f2da2201fb37de049efc63e
SHA187488ab791ca1e0a18258551b7c4ac0c7a182e07
SHA256bfd727bbf667e7082461aefec3d65918c185b26e9698fac4c26b76d33a16bce7
SHA512696836f7a79022ac191ca19a1ef759949bbeb51ba269bde59ed722d353828ca3f929c521eb1954e583098956736f0e588fa9e4c6e32b1b22966c735319de6ddc
-
memory/1376-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1376-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2672-119-0x00000000005E0000-0x00000000005E9000-memory.dmpFilesize
36KB
-
memory/2836-125-0x00000000006B0000-0x00000000006D9000-memory.dmpFilesize
164KB
-
memory/3028-122-0x00000000008B0000-0x00000000008C6000-memory.dmpFilesize
88KB
-
memory/3028-128-0x0000000000910000-0x0000000000926000-memory.dmpFilesize
88KB