Analysis
-
max time kernel
162s -
max time network
132s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 17:03
Static task
static1
Behavioral task
behavioral1
Sample
bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe
Resource
win10-en-20211208
General
-
Target
bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe
-
Size
353KB
-
MD5
3a78923d6d173ad0609355abe4784467
-
SHA1
e3ca6fe63baaf13893dc1765745b043ea69c7db2
-
SHA256
bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12
-
SHA512
8b7f539096fcb8f571f8eea04423995bc87b27558108b37bfe730ccf5113aad01d9c5272e85bb289b435fce155e32b1e909059325051189024b1c40aa9cf2be5
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3036 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exedescription pid process target process PID 3948 set thread context of 812 3948 bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exepid process 812 bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe 812 bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3036 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exepid process 812 bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exedescription pid process target process PID 3948 wrote to memory of 812 3948 bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe PID 3948 wrote to memory of 812 3948 bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe PID 3948 wrote to memory of 812 3948 bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe PID 3948 wrote to memory of 812 3948 bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe PID 3948 wrote to memory of 812 3948 bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe PID 3948 wrote to memory of 812 3948 bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe"C:\Users\Admin\AppData\Local\Temp\bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe"C:\Users\Admin\AppData\Local\Temp\bacd350225b37e7859cfb631a9e0b7f9d657b9af1c9ab983cd0c5fe26b4a5d12.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/812-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/812-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3036-122-0x0000000001130000-0x0000000001146000-memory.dmpFilesize
88KB
-
memory/3948-119-0x00000000004F0000-0x000000000063A000-memory.dmpFilesize
1.3MB