smokeloader | b6ec96043dba7722cac4ed24b6979fc71a758bdf18ca44353c19194c172bf621

Analysis

max time kernel
2s
max time network
10s
platform
windows7_x64
resource
win7v20201028
submitted
03-03-2021 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ac835c38d4d0c6466e641427a2cf8f1.exe
Size

32KB
MD5

9ac835c38d4d0c6466e641427a2cf8f1
SHA1

108a8b5f1eaf9ef078a3dc0210e6aa961d6b3787
SHA256

b6ec96043dba7722cac4ed24b6979fc71a758bdf18ca44353c19194c172bf621
SHA512

226480dc7c6d7f3eee39365e59cc317f203da475beb85d599fee3ae02d64306869eda37ee22076100b240904a2c15b53249efd0020deb6526639d49d4e236cc8

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2018

http://cfsmarthome.net/1/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9ac835c38d4d0c6466e641427a2cf8f1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	9ac835c38d4d0c6466e641427a2cf8f1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	9ac835c38d4d0c6466e641427a2cf8f1.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

9ac835c38d4d0c6466e641427a2cf8f1.exe

pid process

776 9ac835c38d4d0c6466e641427a2cf8f1.exe
776 9ac835c38d4d0c6466e641427a2cf8f1.exe

pid	process
776	9ac835c38d4d0c6466e641427a2cf8f1.exe
776	9ac835c38d4d0c6466e641427a2cf8f1.exe

C:\Users\Admin\AppData\Local\Temp\9ac835c38d4d0c6466e641427a2cf8f1.exe
"C:\Users\Admin\AppData\Local\Temp\9ac835c38d4d0c6466e641427a2cf8f1.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
PID:776

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-2-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1248-3-0x0000000002780000-0x0000000002781000-memory.dmp

Filesize
4KB

Download
memory/1248-4-0x0000000002200000-0x0000000002215000-memory.dmp

Filesize
84KB

Download