Analysis
-
max time kernel
157s -
max time network
144s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 13:42
Static task
static1
Behavioral task
behavioral1
Sample
e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe
Resource
win10-en-20211208
General
-
Target
e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe
-
Size
352KB
-
MD5
bd47c8d154580c006584c167678e80a0
-
SHA1
874eda0e9a278ca597523e013e802142eab6dc1d
-
SHA256
e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7
-
SHA512
d696f94d7b31aedc752b67818a3bce4fc6d1b6752560408a0ad17a34f16ef4140d8b4e3847e7ba1ba29ff024416253b33ed034a56cea1eace4111e6ea1b34a1f
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3040 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exedescription pid process target process PID 2708 set thread context of 1304 2708 e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exepid process 1304 e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe 1304 e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3040 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exepid process 1304 e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exedescription pid process target process PID 2708 wrote to memory of 1304 2708 e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe PID 2708 wrote to memory of 1304 2708 e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe PID 2708 wrote to memory of 1304 2708 e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe PID 2708 wrote to memory of 1304 2708 e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe PID 2708 wrote to memory of 1304 2708 e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe PID 2708 wrote to memory of 1304 2708 e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe"C:\Users\Admin\AppData\Local\Temp\e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe"C:\Users\Admin\AppData\Local\Temp\e6aab023074dcf5aaef50b082ed9787b5f9a22d91f356d65c1611b0fab7fcbc7.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1304-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1304-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2708-116-0x0000000000570000-0x0000000000579000-memory.dmpFilesize
36KB
-
memory/3040-119-0x0000000000CD0000-0x0000000000CE6000-memory.dmpFilesize
88KB