Analysis
-
max time kernel
158s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
29-01-2022 01:02
Static task
static1
Behavioral task
behavioral1
Sample
91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe
Resource
win10v2004-en-20220112
General
-
Target
91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe
-
Size
318KB
-
MD5
eeeb3c0b0a2873294a977512aa571396
-
SHA1
2b0e81a78cf5afdd870fe935b0e7a30dd2b3e2ca
-
SHA256
91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b
-
SHA512
93d96f782c9196d06490891013024e9110af48393915d466fe31e8b5722d86b64abd0c4edae4cb90b0a55286a024bdf92ab85a8ff1c132f19577bc984a2194f3
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exedescription pid process target process PID 3740 set thread context of 3204 3740 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exepid process 3204 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe 3204 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2492 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exepid process 3204 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exedescription pid process target process PID 3740 wrote to memory of 3204 3740 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe PID 3740 wrote to memory of 3204 3740 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe PID 3740 wrote to memory of 3204 3740 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe PID 3740 wrote to memory of 3204 3740 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe PID 3740 wrote to memory of 3204 3740 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe PID 3740 wrote to memory of 3204 3740 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe 91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe"C:\Users\Admin\AppData\Local\Temp\91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe"C:\Users\Admin\AppData\Local\Temp\91ae5ce01ecb645df0b539fc5db5724c32a3ebf6339a8bc1df02deb41e42587b.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 5dfbd1e0f857fe77020dd2147e779b34 /MdMpPJ1D06TDUBVvcW6ng.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2492-134-0x00000000024F0000-0x0000000002506000-memory.dmpFilesize
88KB
-
memory/3204-132-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3204-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3740-130-0x00000000006F0000-0x00000000006F8000-memory.dmpFilesize
32KB
-
memory/3740-131-0x0000000000700000-0x0000000000709000-memory.dmpFilesize
36KB