Analysis
-
max time kernel
158s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
28-01-2022 15:51
Static task
static1
Behavioral task
behavioral1
Sample
7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe
Resource
win10v2004-en-20220112
General
-
Target
7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe
-
Size
352KB
-
MD5
4a8f313059f16223ed50fe0e4a376883
-
SHA1
820d6c0564839a6b4e5c067ff3d323ca1ec0f441
-
SHA256
7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70
-
SHA512
58c840e99dbb39b07e27f56466e0068b18a6787d5534f273a6a8056c795e234e9428a671afc589170928452241ee41289483c7567e4731ff24e4c88de21b1fb8
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
ihucvwwihucvwwpid process 924 ihucvww 3528 ihucvww -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exeihucvwwdescription pid process target process PID 1636 set thread context of 3236 1636 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe PID 924 set thread context of 3528 924 ihucvww ihucvww -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exeihucvwwdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ihucvww Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ihucvww Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ihucvww -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exepid process 3236 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe 3236 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2440 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exeihucvwwpid process 3236 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe 3528 ihucvww -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2440 Token: SeCreatePagefilePrivilege 2440 Token: SeShutdownPrivilege 2440 Token: SeCreatePagefilePrivilege 2440 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exeihucvwwdescription pid process target process PID 1636 wrote to memory of 3236 1636 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe PID 1636 wrote to memory of 3236 1636 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe PID 1636 wrote to memory of 3236 1636 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe PID 1636 wrote to memory of 3236 1636 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe PID 1636 wrote to memory of 3236 1636 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe PID 1636 wrote to memory of 3236 1636 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe 7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe PID 924 wrote to memory of 3528 924 ihucvww ihucvww PID 924 wrote to memory of 3528 924 ihucvww ihucvww PID 924 wrote to memory of 3528 924 ihucvww ihucvww PID 924 wrote to memory of 3528 924 ihucvww ihucvww PID 924 wrote to memory of 3528 924 ihucvww ihucvww PID 924 wrote to memory of 3528 924 ihucvww ihucvww
Processes
-
C:\Users\Admin\AppData\Local\Temp\7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe"C:\Users\Admin\AppData\Local\Temp\7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe"C:\Users\Admin\AppData\Local\Temp\7321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe b06c81f1ccec57328007159af70db866 SQSLfwJpYki1XtwICMDPjw.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
-
C:\Users\Admin\AppData\Roaming\ihucvwwC:\Users\Admin\AppData\Roaming\ihucvww1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ihucvwwC:\Users\Admin\AppData\Roaming\ihucvww2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ihucvwwMD5
4a8f313059f16223ed50fe0e4a376883
SHA1820d6c0564839a6b4e5c067ff3d323ca1ec0f441
SHA2567321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70
SHA51258c840e99dbb39b07e27f56466e0068b18a6787d5534f273a6a8056c795e234e9428a671afc589170928452241ee41289483c7567e4731ff24e4c88de21b1fb8
-
C:\Users\Admin\AppData\Roaming\ihucvwwMD5
4a8f313059f16223ed50fe0e4a376883
SHA1820d6c0564839a6b4e5c067ff3d323ca1ec0f441
SHA2567321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70
SHA51258c840e99dbb39b07e27f56466e0068b18a6787d5534f273a6a8056c795e234e9428a671afc589170928452241ee41289483c7567e4731ff24e4c88de21b1fb8
-
C:\Users\Admin\AppData\Roaming\ihucvwwMD5
4a8f313059f16223ed50fe0e4a376883
SHA1820d6c0564839a6b4e5c067ff3d323ca1ec0f441
SHA2567321f6354cc195b100bc6bf2cc3fcb7b700a96bb6f8505841c4438b61e058d70
SHA51258c840e99dbb39b07e27f56466e0068b18a6787d5534f273a6a8056c795e234e9428a671afc589170928452241ee41289483c7567e4731ff24e4c88de21b1fb8
-
memory/924-137-0x00000000007A0000-0x00000000007CA000-memory.dmpFilesize
168KB
-
memory/1636-130-0x0000000000590000-0x00000000005BB000-memory.dmpFilesize
172KB
-
memory/1636-131-0x0000000000560000-0x0000000000569000-memory.dmpFilesize
36KB
-
memory/2440-134-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/2440-141-0x0000000000B80000-0x0000000000B96000-memory.dmpFilesize
88KB
-
memory/3236-132-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3236-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3528-140-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB