smokeloader | c390f1f12cf19aa6e9cd4745f24453f6321e5baaa061e6af1769aa90e8e86fe4

Analysis

max time kernel
112s
max time network
113s
platform
windows7_x64
resource
win7v20201028
submitted
22-12-2020 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d92882345373d476c839231ec52d8047.exe
Size

32KB
MD5

d92882345373d476c839231ec52d8047
SHA1

5dc2c5996e4570feb0ea9ba323c8c8bb07d1a889
SHA256

c390f1f12cf19aa6e9cd4745f24453f6321e5baaa061e6af1769aa90e8e86fe4
SHA512

a198d70b9f6820bef83d3ef59bb36ce994d8a0bd1b93d79063843bbe1ade5a05c6651ccf6172ecd39b1dcbe7e0ee30384570907bba03010cc8ee57881aac48f1

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2018

http://vipengland.com/2/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

d92882345373d476c839231ec52d8047.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	d92882345373d476c839231ec52d8047.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	d92882345373d476c839231ec52d8047.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

d92882345373d476c839231ec52d8047.exe

pid process

1684 d92882345373d476c839231ec52d8047.exe
1684 d92882345373d476c839231ec52d8047.exe

pid	process
1684	d92882345373d476c839231ec52d8047.exe
1684	d92882345373d476c839231ec52d8047.exe

C:\Users\Admin\AppData\Local\Temp\d92882345373d476c839231ec52d8047.exe
"C:\Users\Admin\AppData\Local\Temp\d92882345373d476c839231ec52d8047.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
PID:1684

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-2-0x0000000000230000-0x0000000000245000-memory.dmp

Filesize
84KB

Download
memory/1684-3-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download