Analysis
-
max time kernel
167s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
28-01-2022 10:25
Static task
static1
Behavioral task
behavioral1
Sample
ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe
Resource
win10v2004-en-20220112
General
-
Target
ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe
-
Size
353KB
-
MD5
4be7a3e011c85f196567c25284b31088
-
SHA1
ab187a3b3d75291791d2e1ee9e9875f88c52b27c
-
SHA256
ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0
-
SHA512
d317d3d38669a74a8da01159af0b952609c60291d1ecaa44b8da4118292e76d2035e89f79708b12410ca35ae0a2610ee949cb5aebb05f7e32d14678d6754ecfc
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exedescription pid process target process PID 3872 set thread context of 3220 3872 ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exepid process 3220 ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe 3220 ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2432 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exepid process 3220 ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exedescription pid process target process PID 3872 wrote to memory of 3220 3872 ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe PID 3872 wrote to memory of 3220 3872 ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe PID 3872 wrote to memory of 3220 3872 ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe PID 3872 wrote to memory of 3220 3872 ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe PID 3872 wrote to memory of 3220 3872 ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe PID 3872 wrote to memory of 3220 3872 ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe"C:\Users\Admin\AppData\Local\Temp\ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe"C:\Users\Admin\AppData\Local\Temp\ea164dacd96c7c2f93dcc8ddb9798def103def1b7e1febad0813a521346106e0.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 51ea8cde1daa26bb0fc9611d270d6373 zI7tg6i4XkS7qX4zTH8XcA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2432-134-0x0000000002B40000-0x0000000002B56000-memory.dmpFilesize
88KB
-
memory/3220-131-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3220-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3872-130-0x0000000000620000-0x000000000064B000-memory.dmpFilesize
172KB
-
memory/3872-132-0x00000000021C0000-0x00000000021C9000-memory.dmpFilesize
36KB