Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 09:47
Static task
static1
Behavioral task
behavioral1
Sample
ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe
Resource
win10-en-20211208
General
-
Target
ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe
-
Size
356KB
-
MD5
fb50f4f94abd48dea11d5175150e1a64
-
SHA1
840a7f3aa9d41f7b33b87052578b90ea5be549f9
-
SHA256
ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15
-
SHA512
f988090b3ae962aab0231e7478bbac401966920293176c6c70d346d30b3472b575bf781a261a24e18030f4b8e7e94c6ef7ca7887cf8b0fc3c01ea5171b8fa7ee
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 396 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exedescription pid process target process PID 3712 set thread context of 4008 3712 ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exepid process 4008 ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe 4008 ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 396 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exepid process 4008 ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exedescription pid process target process PID 3712 wrote to memory of 4008 3712 ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe PID 3712 wrote to memory of 4008 3712 ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe PID 3712 wrote to memory of 4008 3712 ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe PID 3712 wrote to memory of 4008 3712 ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe PID 3712 wrote to memory of 4008 3712 ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe PID 3712 wrote to memory of 4008 3712 ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe"C:\Users\Admin\AppData\Local\Temp\ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe"C:\Users\Admin\AppData\Local\Temp\ca6bb32ad6e91b3132ff75a85bc74aad1179297bf204e3670004a0f984bc0b15.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-119-0x0000000000AB0000-0x0000000000AC6000-memory.dmpFilesize
88KB
-
memory/3712-115-0x0000000000740000-0x000000000076A000-memory.dmpFilesize
168KB
-
memory/3712-116-0x0000000000700000-0x0000000000709000-memory.dmpFilesize
36KB
-
memory/4008-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4008-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB