Analysis
-
max time kernel
165s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 17:45
Static task
static1
Behavioral task
behavioral1
Sample
5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe
Resource
win10-en-20211208
General
-
Target
5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe
-
Size
352KB
-
MD5
2faf0358aaf0f2b2693eead6f16e0f85
-
SHA1
2f9cd18c2932edc158cd0e590de3048f68b123e2
-
SHA256
5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95
-
SHA512
471acfd7a8344b91b4c28128cb6ae4884895d118697031a189cb494a86b9adba3f03556e9e1fa17d3a906d5659d728e0f2a9259f7bb2d49acf87817b0531e325
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3004 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exedescription pid process target process PID 2736 set thread context of 3932 2736 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exepid process 3932 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe 3932 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3004 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exepid process 3932 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exedescription pid process target process PID 2736 wrote to memory of 3932 2736 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe PID 2736 wrote to memory of 3932 2736 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe PID 2736 wrote to memory of 3932 2736 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe PID 2736 wrote to memory of 3932 2736 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe PID 2736 wrote to memory of 3932 2736 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe PID 2736 wrote to memory of 3932 2736 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe 5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe"C:\Users\Admin\AppData\Local\Temp\5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe"C:\Users\Admin\AppData\Local\Temp\5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2736-118-0x0000000000700000-0x0000000000729000-memory.dmpFilesize
164KB
-
memory/2736-119-0x0000000000580000-0x00000000006CA000-memory.dmpFilesize
1.3MB
-
memory/3004-122-0x0000000000DC0000-0x0000000000DD6000-memory.dmpFilesize
88KB
-
memory/3932-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3932-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB