smokeloader | 604ab38ce18503e51024931890ed855923bf6dbdbfa11f5e55cec03dd274bbc9

General

Target

onir0.bin.exe
Size

112KB
MD5

c989356bdc4ffc9b4752acecfddb551d
SHA1

fff0e011c492e174a3175c3ddb2ee0d6ed9d7285
SHA256

8afc2dd7267bbf83a46549f4e7731f6473610c33bc9ee41b4dd0b994c3a29473
SHA512

f51769eed207b7b0e9387c9bc13d46502f0c25086c6f1ce8d16678bbe639f06efb799959efac10aefd6d92dd08310216d2929178ebee3f2c73ecad286c89da1f

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 2 IoCs

Processes:

AB2D.tmp.exeACF3.tmp.exe

pid process

1744 AB2D.tmp.exe
1088 ACF3.tmp.exe
Deletes itself 1 IoCs

Processes:

pid process

1260
Loads dropped DLL 1 IoCs

Processes:

onir0.bin.exe

pid process

1900 onir0.bin.exe

pid	process
1744	AB2D.tmp.exe
1088	ACF3.tmp.exe

pid	process
1260

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

onir0.bin.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	onir0.bin.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	onir0.bin.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	onir0.bin.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F60B40C1-2FF0-11EB-9E5C-424ABE5A776C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious behavior: EnumeratesProcesses 610 IoCs

Processes:

onir0.bin.exe

pid	process
1900	onir0.bin.exe
1900	onir0.bin.exe
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

onir0.bin.exe

pid process

1900 onir0.bin.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exe

pid process

1260
1260
1260
1260
624 iexplore.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

pid process

1260
1260
1260
1260
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

624 iexplore.exe
624 iexplore.exe
1548 IEXPLORE.EXE
1548 IEXPLORE.EXE

pid	process
1260
1260
1260
1260
624	iexplore.exe

pid	process
1260
1260
1260
1260

pid	process
624	iexplore.exe
624	iexplore.exe
1548	IEXPLORE.EXE
1548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1260 wrote to memory of 1744	1260		AB2D.tmp.exe
PID 1260 wrote to memory of 1744	1260		AB2D.tmp.exe
PID 1260 wrote to memory of 1744	1260		AB2D.tmp.exe
PID 1260 wrote to memory of 1744	1260		AB2D.tmp.exe
PID 1260 wrote to memory of 1088	1260		ACF3.tmp.exe
PID 1260 wrote to memory of 1088	1260		ACF3.tmp.exe
PID 1260 wrote to memory of 1088	1260		ACF3.tmp.exe
PID 1260 wrote to memory of 1088	1260		ACF3.tmp.exe
PID 624 wrote to memory of 1548	624	iexplore.exe	IEXPLORE.EXE
PID 624 wrote to memory of 1548	624	iexplore.exe	IEXPLORE.EXE
PID 624 wrote to memory of 1548	624	iexplore.exe	IEXPLORE.EXE
PID 624 wrote to memory of 1548	624	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\onir0.bin.exe
"C:\Users\Admin\AppData\Local\Temp\onir0.bin.exe"
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1900

C:\Users\Admin\AppData\Local\Temp\AB2D.tmp.exe
C:\Users\Admin\AppData\Local\Temp\AB2D.tmp.exe
1⤵
- Executes dropped EXE
PID:1744

C:\Users\Admin\AppData\Local\Temp\ACF3.tmp.exe
C:\Users\Admin\AppData\Local\Temp\ACF3.tmp.exe
1⤵
- Executes dropped EXE
PID:1088

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:624 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AB2D.tmp.exe
MD5
86fc9993f4fe92809513a02d907205cd

SHA1
a23217fa44754496be797902abe54aa661dc7774

SHA256
edbb56fe63e565c456de8153a6c6782dc6697b6dac509eeb19a99e462d9e717d

SHA512
0242225e1b5c2df539893cdc1fb873e8a7fcf30356d30474bb1ad68ed9f3126673c253d75141ef89b48953c8c11898d0d73d2aaa618b4f6e8b604a152a3a45e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ACF3.tmp.exe
MD5
dd27ae12604dd29819d082e8140f4100

SHA1
6d36e154d8db8ef33ce3b3d0fa7bbaf57fb3c8ac

SHA256
c046cb43c97a7a25a97ac98951688286c57e4b987743729320b647949e68a0dd

SHA512
5a56a4ddc73816d0769a5a54e98dced1f4de3edf1807e718e5616e1bd0b8033c4defa7005d4d8134e2ed0137c41b1c7b583884195faff0287792be495d950a85

Download Submit
\Users\Admin\AppData\Local\Temp\2F6.tmp
MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
memory/476-12-0x000007FEF5AE0000-0x000007FEF5D5A000-memory.dmp

Filesize
2.5MB

Download
memory/1088-11-0x0000000004880000-0x0000000004891000-memory.dmp

Filesize
68KB

Download
memory/1088-10-0x000000000026B000-0x000000000026C000-memory.dmp

Filesize
4KB

Download
memory/1088-6-0x0000000000000000-mapping.dmp

Download
memory/1260-3-0x0000000002CA0000-0x0000000002CB6000-memory.dmp

Filesize
88KB

Download
memory/1548-13-0x0000000000000000-mapping.dmp

Download
memory/1548-17-0x0000000006090000-0x00000000060B3000-memory.dmp

Filesize
140KB

Download
memory/1744-8-0x00000000030AB000-0x00000000030AC000-memory.dmp

Filesize
4KB

Download
memory/1744-9-0x00000000048B0000-0x00000000048C1000-memory.dmp

Filesize
68KB

Download
memory/1744-4-0x0000000000000000-mapping.dmp

Download
memory/1900-0-0x000000000316B000-0x000000000316C000-memory.dmp

Filesize
4KB

Download
memory/1900-1-0x00000000047E0000-0x00000000047F1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads