Analysis
-
max time kernel
151s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
28-01-2022 11:56
Static task
static1
Behavioral task
behavioral1
Sample
e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe
Resource
win10v2004-en-20220112
General
-
Target
e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe
-
Size
352KB
-
MD5
425b2d09dc9b30a2659d0401f4aaba79
-
SHA1
f7a7057fb991161a56bf5054561ca6c66c707863
-
SHA256
e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185
-
SHA512
d0f8e6d25cf9ad28e5170d782c61d51cb7dea40ede1dc6b866834c6a5f1c27f91d3b970726301f3fb41e8669ed82f3ccfc10064b649a13563dbb16cb7926e2ed
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exedescription pid process target process PID 1268 set thread context of 2248 1268 e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exepid process 2248 e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe 2248 e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 2316 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2316 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exepid process 2248 e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2316 Token: SeCreatePagefilePrivilege 2316 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exedescription pid process target process PID 1268 wrote to memory of 2248 1268 e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe PID 1268 wrote to memory of 2248 1268 e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe PID 1268 wrote to memory of 2248 1268 e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe PID 1268 wrote to memory of 2248 1268 e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe PID 1268 wrote to memory of 2248 1268 e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe PID 1268 wrote to memory of 2248 1268 e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe"C:\Users\Admin\AppData\Local\Temp\e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe"C:\Users\Admin\AppData\Local\Temp\e3b31b540839dffff92b5ee74323e3ca87954f717028d633dcb63fc011da8185.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe c0333e70e73cf83ceca7e83132d120bf VsQyJh57YUu1dc/cdndsNA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1268-130-0x0000000000730000-0x000000000075B000-memory.dmpFilesize
172KB
-
memory/1268-131-0x0000000000720000-0x0000000000729000-memory.dmpFilesize
36KB
-
memory/2248-132-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2248-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2316-134-0x00000000015C0000-0x00000000015D6000-memory.dmpFilesize
88KB