Analysis
-
max time kernel
153s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
29-01-2022 00:31
Static task
static1
Behavioral task
behavioral1
Sample
04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe
Resource
win10v2004-en-20220112
General
-
Target
04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe
-
Size
318KB
-
MD5
e7d223d7731460991bf73b725e8c9a25
-
SHA1
75ef13930b7560ed6f852f5fc498692506d71756
-
SHA256
04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187
-
SHA512
e2f7ed696c408eebdb9204408df3657c809dbad15ebf1ebef6782fd67115196f070b9a64144e671e0b57a4b3596065f680ebda96b61f24d82a8d4b033fa7d297
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
Processes:
rjrutcipid process 4000 rjrutci -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exedescription pid process target process PID 3576 set thread context of 1320 3576 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exepid process 1320 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe 1320 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2308 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exepid process 1320 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2308 Token: SeCreatePagefilePrivilege 2308 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exedescription pid process target process PID 3576 wrote to memory of 1320 3576 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe PID 3576 wrote to memory of 1320 3576 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe PID 3576 wrote to memory of 1320 3576 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe PID 3576 wrote to memory of 1320 3576 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe PID 3576 wrote to memory of 1320 3576 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe PID 3576 wrote to memory of 1320 3576 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe 04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe"C:\Users\Admin\AppData\Local\Temp\04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe"C:\Users\Admin\AppData\Local\Temp\04ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 3b64e160319ae2a088d845aa4819d1e6 HFtARDn67Eq0BQlFwRe/tg.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Roaming\rjrutciC:\Users\Admin\AppData\Roaming\rjrutci1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\rjrutciMD5
e7d223d7731460991bf73b725e8c9a25
SHA175ef13930b7560ed6f852f5fc498692506d71756
SHA25604ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187
SHA512e2f7ed696c408eebdb9204408df3657c809dbad15ebf1ebef6782fd67115196f070b9a64144e671e0b57a4b3596065f680ebda96b61f24d82a8d4b033fa7d297
-
C:\Users\Admin\AppData\Roaming\rjrutciMD5
e7d223d7731460991bf73b725e8c9a25
SHA175ef13930b7560ed6f852f5fc498692506d71756
SHA25604ad6dff980adf0c8eb6570408f677448fb43b65ae7bcbed830e155301201187
SHA512e2f7ed696c408eebdb9204408df3657c809dbad15ebf1ebef6782fd67115196f070b9a64144e671e0b57a4b3596065f680ebda96b61f24d82a8d4b033fa7d297
-
memory/1320-132-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1320-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2308-134-0x0000000000CC0000-0x0000000000CD6000-memory.dmpFilesize
88KB
-
memory/3576-131-0x0000000000600000-0x0000000000609000-memory.dmpFilesize
36KB
-
memory/3576-130-0x00000000005E0000-0x00000000005E9000-memory.dmpFilesize
36KB