Analysis
-
max time kernel
165s -
max time network
166s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-01-2022 00:21
Static task
static1
Behavioral task
behavioral1
Sample
c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe
Resource
win10-en-20211208
General
-
Target
c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe
-
Size
318KB
-
MD5
05bfc9fc42cd23ec098ea029894ea40f
-
SHA1
b236713eb6e96d78178f344d901e6d497d7af3dd
-
SHA256
c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277
-
SHA512
f630ee339bb7b3f34cdb3699c6fdfec785729f34cb6a6101cc41034f509be5e7744c3be5e5f0673eeb9309636c38753ec19d607fb6970c4d0a7dff74c0ac0aca
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 372 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exedescription pid process target process PID 3668 set thread context of 4312 3668 c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exepid process 4312 c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe 4312 c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 372 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exepid process 4312 c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exedescription pid process target process PID 3668 wrote to memory of 4312 3668 c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe PID 3668 wrote to memory of 4312 3668 c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe PID 3668 wrote to memory of 4312 3668 c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe PID 3668 wrote to memory of 4312 3668 c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe PID 3668 wrote to memory of 4312 3668 c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe PID 3668 wrote to memory of 4312 3668 c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe"C:\Users\Admin\AppData\Local\Temp\c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe"C:\Users\Admin\AppData\Local\Temp\c088a2a1e76a5d2d07e9bf47db370dcc53dbfc7c957e947124491739ce34d277.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/372-121-0x00000000012F0000-0x0000000001306000-memory.dmpFilesize
88KB
-
memory/3668-117-0x0000000000460000-0x000000000050E000-memory.dmpFilesize
696KB
-
memory/3668-118-0x0000000002180000-0x0000000002189000-memory.dmpFilesize
36KB
-
memory/4312-119-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4312-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB