Analysis
-
max time kernel
164s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 14:49
Static task
static1
Behavioral task
behavioral1
Sample
5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe
Resource
win10-en-20211208
General
-
Target
5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe
-
Size
351KB
-
MD5
8b3b1be30ddf3f30563db31adcfefe03
-
SHA1
b3afa6abbc2874b4d626c15db0541edc54ea5a32
-
SHA256
5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d
-
SHA512
2fc08789f0a82a9664e88f928634e6916084cff6ca8605c569040455db56bcec3c8d135e814aa205f4e260d0c30a935c67f36fbd0c03c608b25e895b2f48718b
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2928 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exedescription pid process target process PID 2944 set thread context of 656 2944 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exepid process 656 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe 656 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2928 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exepid process 656 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exedescription pid process target process PID 2944 wrote to memory of 656 2944 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe PID 2944 wrote to memory of 656 2944 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe PID 2944 wrote to memory of 656 2944 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe PID 2944 wrote to memory of 656 2944 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe PID 2944 wrote to memory of 656 2944 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe PID 2944 wrote to memory of 656 2944 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe 5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe"C:\Users\Admin\AppData\Local\Temp\5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe"C:\Users\Admin\AppData\Local\Temp\5dad6fcb977a362dbe329eea517a926c697af169549c74545a35d7491544356d.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/656-119-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/656-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2928-122-0x0000000000680000-0x0000000000696000-memory.dmpFilesize
88KB
-
memory/2944-118-0x00000000006C0000-0x00000000006E9000-memory.dmpFilesize
164KB
-
memory/2944-120-0x0000000000490000-0x00000000005DA000-memory.dmpFilesize
1.3MB