Analysis
-
max time kernel
153s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
29-01-2022 12:54
Static task
static1
Behavioral task
behavioral1
Sample
0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe
Resource
win10-en-20211208
General
-
Target
0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe
-
Size
317KB
-
MD5
832d55530ba86650884b5d2c4ab59f62
-
SHA1
d7e3e1fa3375261e99b2eab3a13f6fa5444debac
-
SHA256
0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c
-
SHA512
cd38ab6acba1e3899e4ac0ba4e037a2ce63a176562bd71d55dc5037c4d3564072f9f653f099646085e272a45518b394dd9b2781e3f25fecb3409f45d2c0c001a
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1216 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exedescription pid process target process PID 756 set thread context of 1916 756 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exepid process 1916 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe 1916 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exepid process 1916 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1216 1216 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1216 1216 -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exedescription pid process target process PID 756 wrote to memory of 1916 756 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe PID 756 wrote to memory of 1916 756 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe PID 756 wrote to memory of 1916 756 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe PID 756 wrote to memory of 1916 756 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe PID 756 wrote to memory of 1916 756 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe PID 756 wrote to memory of 1916 756 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe PID 756 wrote to memory of 1916 756 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe 0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe"C:\Users\Admin\AppData\Local\Temp\0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe"C:\Users\Admin\AppData\Local\Temp\0d4992cbe7a7986795931a122180a1cf5e758d695544de42a4ca630812eee03c.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/756-54-0x0000000000220000-0x0000000000228000-memory.dmpFilesize
32KB
-
memory/756-55-0x0000000000230000-0x0000000000239000-memory.dmpFilesize
36KB
-
memory/1216-59-0x00000000029E0000-0x00000000029F6000-memory.dmpFilesize
88KB
-
memory/1916-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1916-57-0x0000000075531000-0x0000000075533000-memory.dmpFilesize
8KB
-
memory/1916-58-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB