Analysis
-
max time kernel
166s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
28-01-2022 20:07
Static task
static1
Behavioral task
behavioral1
Sample
63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe
Resource
win10v2004-en-20220112
General
-
Target
63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe
-
Size
351KB
-
MD5
79cd578c6198391d8ce8b1ccc1b301d1
-
SHA1
adc7a417da2c9c01c4664c1b740c317f16dcef5c
-
SHA256
63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086
-
SHA512
7d497694a48182689c78abdbf8bbc13e1937900a4728ce7c02e06033d3b1923337bec3def940dfc3896746fab59b5b00a6e2e8de0126eff19d490290d3ee31e4
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
dgffwcjdgffwcjpid process 3976 dgffwcj 3996 dgffwcj -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exedgffwcjdescription pid process target process PID 2236 set thread context of 3336 2236 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe PID 3976 set thread context of 3996 3976 dgffwcj dgffwcj -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exedgffwcjdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dgffwcj Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dgffwcj Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dgffwcj -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exepid process 3336 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe 3336 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2520 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exedgffwcjpid process 3336 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe 3996 dgffwcj -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2520 Token: SeCreatePagefilePrivilege 2520 Token: SeShutdownPrivilege 2520 Token: SeCreatePagefilePrivilege 2520 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exedgffwcjdescription pid process target process PID 2236 wrote to memory of 3336 2236 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe PID 2236 wrote to memory of 3336 2236 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe PID 2236 wrote to memory of 3336 2236 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe PID 2236 wrote to memory of 3336 2236 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe PID 2236 wrote to memory of 3336 2236 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe PID 2236 wrote to memory of 3336 2236 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe 63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe PID 3976 wrote to memory of 3996 3976 dgffwcj dgffwcj PID 3976 wrote to memory of 3996 3976 dgffwcj dgffwcj PID 3976 wrote to memory of 3996 3976 dgffwcj dgffwcj PID 3976 wrote to memory of 3996 3976 dgffwcj dgffwcj PID 3976 wrote to memory of 3996 3976 dgffwcj dgffwcj PID 3976 wrote to memory of 3996 3976 dgffwcj dgffwcj
Processes
-
C:\Users\Admin\AppData\Local\Temp\63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe"C:\Users\Admin\AppData\Local\Temp\63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe"C:\Users\Admin\AppData\Local\Temp\63fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 1a452fae02be163ddd945037454bcca4 omc2//L2GE+ip2xL58nQkA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Roaming\dgffwcjC:\Users\Admin\AppData\Roaming\dgffwcj1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dgffwcjC:\Users\Admin\AppData\Roaming\dgffwcj2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dgffwcjMD5
79cd578c6198391d8ce8b1ccc1b301d1
SHA1adc7a417da2c9c01c4664c1b740c317f16dcef5c
SHA25663fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086
SHA5127d497694a48182689c78abdbf8bbc13e1937900a4728ce7c02e06033d3b1923337bec3def940dfc3896746fab59b5b00a6e2e8de0126eff19d490290d3ee31e4
-
C:\Users\Admin\AppData\Roaming\dgffwcjMD5
79cd578c6198391d8ce8b1ccc1b301d1
SHA1adc7a417da2c9c01c4664c1b740c317f16dcef5c
SHA25663fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086
SHA5127d497694a48182689c78abdbf8bbc13e1937900a4728ce7c02e06033d3b1923337bec3def940dfc3896746fab59b5b00a6e2e8de0126eff19d490290d3ee31e4
-
C:\Users\Admin\AppData\Roaming\dgffwcjMD5
79cd578c6198391d8ce8b1ccc1b301d1
SHA1adc7a417da2c9c01c4664c1b740c317f16dcef5c
SHA25663fd7eed07b783897ff9b1926eb9924a37a57d4af6803958299d5c303a1d1086
SHA5127d497694a48182689c78abdbf8bbc13e1937900a4728ce7c02e06033d3b1923337bec3def940dfc3896746fab59b5b00a6e2e8de0126eff19d490290d3ee31e4
-
memory/2236-130-0x00000000005B0000-0x00000000005DB000-memory.dmpFilesize
172KB
-
memory/2236-131-0x0000000000550000-0x0000000000559000-memory.dmpFilesize
36KB
-
memory/2520-134-0x0000000001380000-0x0000000001396000-memory.dmpFilesize
88KB
-
memory/2520-148-0x00000000013B0000-0x00000000013C6000-memory.dmpFilesize
88KB
-
memory/3336-132-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3336-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3976-144-0x00000000004F0000-0x000000000051B000-memory.dmpFilesize
172KB
-
memory/3996-147-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB