Analysis
-
max time kernel
151s -
max time network
132s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 14:27
Static task
static1
Behavioral task
behavioral1
Sample
f43e2e9f0b18e32408c3e4d628ea0f74.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f43e2e9f0b18e32408c3e4d628ea0f74.exe
Resource
win10-en-20211208
General
-
Target
f43e2e9f0b18e32408c3e4d628ea0f74.exe
-
Size
352KB
-
MD5
f43e2e9f0b18e32408c3e4d628ea0f74
-
SHA1
90433a3494e734fa0a14441906302b60ded3f591
-
SHA256
98ad02342614a473b078f5b12274fa3c9c78779894750fbb7af82664b9e7ffa8
-
SHA512
fc149cdee4e540117d1413729a98bfa50bf237ea007d14ceaaa2275ad87cdcbfc2863dbfca940bde8d69f5f2bd0a90680d17e27c434f551af6a9f9294f3917a3
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 396 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f43e2e9f0b18e32408c3e4d628ea0f74.exedescription pid process target process PID 1756 set thread context of 4084 1756 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f43e2e9f0b18e32408c3e4d628ea0f74.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f43e2e9f0b18e32408c3e4d628ea0f74.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f43e2e9f0b18e32408c3e4d628ea0f74.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f43e2e9f0b18e32408c3e4d628ea0f74.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f43e2e9f0b18e32408c3e4d628ea0f74.exepid process 4084 f43e2e9f0b18e32408c3e4d628ea0f74.exe 4084 f43e2e9f0b18e32408c3e4d628ea0f74.exe 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 396 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f43e2e9f0b18e32408c3e4d628ea0f74.exepid process 4084 f43e2e9f0b18e32408c3e4d628ea0f74.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f43e2e9f0b18e32408c3e4d628ea0f74.exedescription pid process target process PID 1756 wrote to memory of 4084 1756 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 1756 wrote to memory of 4084 1756 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 1756 wrote to memory of 4084 1756 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 1756 wrote to memory of 4084 1756 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 1756 wrote to memory of 4084 1756 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe PID 1756 wrote to memory of 4084 1756 f43e2e9f0b18e32408c3e4d628ea0f74.exe f43e2e9f0b18e32408c3e4d628ea0f74.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f43e2e9f0b18e32408c3e4d628ea0f74.exe"C:\Users\Admin\AppData\Local\Temp\f43e2e9f0b18e32408c3e4d628ea0f74.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f43e2e9f0b18e32408c3e4d628ea0f74.exe"C:\Users\Admin\AppData\Local\Temp\f43e2e9f0b18e32408c3e4d628ea0f74.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-119-0x0000000000AB0000-0x0000000000AC6000-memory.dmpFilesize
88KB
-
memory/1756-116-0x00000000004E0000-0x00000000004E9000-memory.dmpFilesize
36KB
-
memory/4084-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4084-118-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB