Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-05-2022 13:50
Static task
static1
Behavioral task
behavioral1
Sample
787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe
Resource
win10v2004-20220414-en
General
-
Target
787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe
-
Size
247KB
-
MD5
f34ad3cb33b7e41126e45906e4ddf6f4
-
SHA1
a86d709c56ee2f5b42b16a99a6c6ee6b5edfb5f3
-
SHA256
787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823
-
SHA512
54610c0d429dad91a3a5fdfd1c03b889999785a48e9e096345bbe709520e518d881cfd0071b9325ec4628db542e62046d7a6ae1b2c81d9754cd20f73250ef37b
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exedescription pid process target process PID 1276 set thread context of 940 1276 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exepid process 940 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe 940 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exepid process 940 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exedescription pid process target process PID 1276 wrote to memory of 940 1276 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe PID 1276 wrote to memory of 940 1276 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe PID 1276 wrote to memory of 940 1276 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe PID 1276 wrote to memory of 940 1276 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe PID 1276 wrote to memory of 940 1276 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe PID 1276 wrote to memory of 940 1276 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe PID 1276 wrote to memory of 940 1276 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe 787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe"C:\Users\Admin\AppData\Local\Temp\787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe"C:\Users\Admin\AppData\Local\Temp\787cd70763bab5a14d9ecc58abe2dc0ed844b5251266cb3ccd8d6e97b3042823.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:940
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/940-55-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/940-56-0x0000000000402F47-mapping.dmp
-
memory/940-58-0x0000000076C01000-0x0000000076C03000-memory.dmpFilesize
8KB
-
memory/940-60-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/940-61-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1276-54-0x00000000008C8000-0x00000000008D9000-memory.dmpFilesize
68KB
-
memory/1276-57-0x00000000008C8000-0x00000000008D9000-memory.dmpFilesize
68KB
-
memory/1276-59-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1352-62-0x0000000002790000-0x00000000027A6000-memory.dmpFilesize
88KB