Analysis
-
max time kernel
160s -
max time network
140s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 10:09
Static task
static1
Behavioral task
behavioral1
Sample
28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe
Resource
win10-en-20211208
General
-
Target
28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe
-
Size
351KB
-
MD5
1d5cea92e2e4027cf11cd5d83d4acc02
-
SHA1
e21087d89c1c4cd7d2955f9a0efac2a48d206a74
-
SHA256
28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2
-
SHA512
24d2cd9426c05dd0a5c9cfc08f59294a280cd1f6c7c55b1fbe99bce1e2db30f4eaa1ea074f9e39f7553b7116fe09df783c463767f3ca791ba784169ad02a125e
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3052 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exedescription pid process target process PID 3032 set thread context of 4036 3032 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exepid process 4036 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe 4036 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3052 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exepid process 4036 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exedescription pid process target process PID 3032 wrote to memory of 4036 3032 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe PID 3032 wrote to memory of 4036 3032 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe PID 3032 wrote to memory of 4036 3032 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe PID 3032 wrote to memory of 4036 3032 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe PID 3032 wrote to memory of 4036 3032 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe PID 3032 wrote to memory of 4036 3032 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe 28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe"C:\Users\Admin\AppData\Local\Temp\28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe"C:\Users\Admin\AppData\Local\Temp\28efcd0162b98ae69e0175c9ba39ddfe0f18b0db3149046c09e8f23a8096d7c2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3032-115-0x0000000000588000-0x0000000000598000-memory.dmpFilesize
64KB
-
memory/3032-116-0x00000000004E0000-0x000000000058E000-memory.dmpFilesize
696KB
-
memory/3052-119-0x0000000000960000-0x0000000000976000-memory.dmpFilesize
88KB
-
memory/4036-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4036-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB