smokeloader | f71c236c3e632754e7b1d2beec8f6127d7835d54a35638b0e9507137ddd2928c

General

Target

2021BR04IS14.doc
Size

1.4MB
MD5

753885c288a257139fc732fa450b1b7c
SHA1

d8e5d2a366bfe2a5c81a87976ed8c4e3dc2788c5
SHA256

f71c236c3e632754e7b1d2beec8f6127d7835d54a35638b0e9507137ddd2928c
SHA512

9db623c6f57d61fc1da835428702650e916e97cb8121403b22941d009f72b66968558bdf2a2e4c85d1f1d0b0c1b321642d5f803e25565206052713cb54160eb7

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2018

C2

http://bristell.com/0/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 3 IoCs

Processes:

EQNEDT32.EXE

flow pid process

6 1588 EQNEDT32.EXE
8 1588 EQNEDT32.EXE
10 1588 EQNEDT32.EXE
Executes dropped EXE 1 IoCs

Processes:

69577.exe

pid process

1964 69577.exe
Loads dropped DLL 2 IoCs

Processes:

EQNEDT32.EXE

pid process

1588 EQNEDT32.EXE
1588 EQNEDT32.EXE

flow	pid	process
6	1588	EQNEDT32.EXE
8	1588	EQNEDT32.EXE
10	1588	EQNEDT32.EXE

pid	process
1964	69577.exe

pid	process
1588	EQNEDT32.EXE
1588	EQNEDT32.EXE

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

69577.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	69577.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	69577.exe

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1588 EQNEDT32.EXE

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1588	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1200 WINWORD.EXE
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

69577.exe

pid process

1964 69577.exe
1964 69577.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1200 WINWORD.EXE
1200 WINWORD.EXE

pid	process
1200	WINWORD.EXE

pid	process
1964	69577.exe
1964	69577.exe

pid	process
1200	WINWORD.EXE
1200	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

WINWORD.EXEEQNEDT32.EXE

description	pid	process	target process
PID 1200 wrote to memory of 1148	1200	WINWORD.EXE	splwow64.exe
PID 1200 wrote to memory of 1148	1200	WINWORD.EXE	splwow64.exe
PID 1200 wrote to memory of 1148	1200	WINWORD.EXE	splwow64.exe
PID 1200 wrote to memory of 1148	1200	WINWORD.EXE	splwow64.exe
PID 1588 wrote to memory of 1964	1588	EQNEDT32.EXE	69577.exe
PID 1588 wrote to memory of 1964	1588	EQNEDT32.EXE	69577.exe
PID 1588 wrote to memory of 1964	1588	EQNEDT32.EXE	69577.exe
PID 1588 wrote to memory of 1964	1588	EQNEDT32.EXE	69577.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2021BR04IS14.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1148

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Public\69577.exe
"C:\Users\Public\69577.exe"
2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
PID:1964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\69577.exe
MD5
4486684e1b0197497e946a50a854ddf0

SHA1
84349c8550af0b9a06142032df5925996e05f5c3

SHA256
d5e3ce92c70d51c53853215bdef05db7c98b7b6bca3c75efa0172a0923b1bda0

SHA512
8eadd0bc08d84e218045663f51024a7d6bfa24a4e6f4f5e39a835d1da9669dedfe49ea5aaa138c54706e697c6fbb904747ca51ce1b16eb9f34470162b7a41174

Download Submit
\Users\Public\69577.exe
MD5
4486684e1b0197497e946a50a854ddf0

SHA1
84349c8550af0b9a06142032df5925996e05f5c3

SHA256
d5e3ce92c70d51c53853215bdef05db7c98b7b6bca3c75efa0172a0923b1bda0

SHA512
8eadd0bc08d84e218045663f51024a7d6bfa24a4e6f4f5e39a835d1da9669dedfe49ea5aaa138c54706e697c6fbb904747ca51ce1b16eb9f34470162b7a41174

Download Submit
\Users\Public\69577.exe
MD5
4486684e1b0197497e946a50a854ddf0

SHA1
84349c8550af0b9a06142032df5925996e05f5c3

SHA256
d5e3ce92c70d51c53853215bdef05db7c98b7b6bca3c75efa0172a0923b1bda0

SHA512
8eadd0bc08d84e218045663f51024a7d6bfa24a4e6f4f5e39a835d1da9669dedfe49ea5aaa138c54706e697c6fbb904747ca51ce1b16eb9f34470162b7a41174

Download Submit
memory/1148-63-0x0000000000000000-mapping.dmp

Download
memory/1148-64-0x000007FEFC221000-0x000007FEFC223000-memory.dmp

Filesize
8KB

Download
memory/1200-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1200-60-0x0000000072DD1000-0x0000000072DD4000-memory.dmp

Filesize
12KB

Download
memory/1200-61-0x0000000070851000-0x0000000070853000-memory.dmp

Filesize
8KB

Download
memory/1200-73-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1256-71-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/1256-72-0x0000000002D20000-0x0000000002D35000-memory.dmp

Filesize
84KB

Download
memory/1588-65-0x00000000768B1000-0x00000000768B3000-memory.dmp

Filesize
8KB

Download
memory/1964-68-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads