Analysis
-
max time kernel
151s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 08:31
Static task
static1
Behavioral task
behavioral1
Sample
869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe
Resource
win10-en-20211208
General
-
Target
869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe
-
Size
356KB
-
MD5
47321e3b5d8f23d2d16635560af06ff6
-
SHA1
7dd8f31bc8d715dffe1c7caf12ab86ef9048699b
-
SHA256
869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525
-
SHA512
5bb6b1f5984893a2e6a1b4ff4040a9d57915baeb8c33749661071316c44ddf9c42500ada848cafd415ef13aa1926d9c74fbd013692448a3a0208f74bfe215c42
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2164 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exedescription pid process target process PID 2000 set thread context of 3628 2000 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exepid process 3628 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe 3628 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 2164 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2164 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exepid process 3628 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exedescription pid process target process PID 2000 wrote to memory of 3628 2000 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe PID 2000 wrote to memory of 3628 2000 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe PID 2000 wrote to memory of 3628 2000 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe PID 2000 wrote to memory of 3628 2000 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe PID 2000 wrote to memory of 3628 2000 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe PID 2000 wrote to memory of 3628 2000 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe 869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe"C:\Users\Admin\AppData\Local\Temp\869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe"C:\Users\Admin\AppData\Local\Temp\869deb19d434bd3fe8b293949c7dcf7e255afba7c29d6999dc9175ba46c9c525.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2000-115-0x0000000000770000-0x000000000079A000-memory.dmpFilesize
168KB
-
memory/2000-116-0x00000000005B0000-0x00000000005B9000-memory.dmpFilesize
36KB
-
memory/2164-119-0x0000000000980000-0x0000000000996000-memory.dmpFilesize
88KB
-
memory/3628-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3628-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB