smokeloader | 6fa32e2ad0bfe2929dcc21d5c49a5db8ce834aa690cb8c5fcba33854b0bb0024

General

Target

17c0023d45e798a2aca1661f490bf3b1.exe
Size

179KB
MD5

17c0023d45e798a2aca1661f490bf3b1
SHA1

d4abe4adadcb1dd91985766f30dd40d19bf8b78b
SHA256

6fa32e2ad0bfe2929dcc21d5c49a5db8ce834aa690cb8c5fcba33854b0bb0024
SHA512

14d4643d1cb508c6491753f297743edb23ab5069167567415578a16ff8438ce99085c01eaed61cece3700e8fccb03e5e58837af0abbe59bf67ff8d0cb4ad13bd

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

3040
Suspicious use of SetThreadContext 1 IoCs

Processes:

17c0023d45e798a2aca1661f490bf3b1.exe

description pid process target process

PID 2752 set thread context of 2196 2752 17c0023d45e798a2aca1661f490bf3b1.exe 17c0023d45e798a2aca1661f490bf3b1.exe

pid	process
3040

description	pid	process	target process
PID 2752 set thread context of 2196	2752	17c0023d45e798a2aca1661f490bf3b1.exe	17c0023d45e798a2aca1661f490bf3b1.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

17c0023d45e798a2aca1661f490bf3b1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	17c0023d45e798a2aca1661f490bf3b1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	17c0023d45e798a2aca1661f490bf3b1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	17c0023d45e798a2aca1661f490bf3b1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

17c0023d45e798a2aca1661f490bf3b1.exe

pid	process
2196	17c0023d45e798a2aca1661f490bf3b1.exe
2196	17c0023d45e798a2aca1661f490bf3b1.exe
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3040
Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

17c0023d45e798a2aca1661f490bf3b1.exe

pid process

2196 17c0023d45e798a2aca1661f490bf3b1.exe
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3040

pid	process
3040

pid	process
3040

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

17c0023d45e798a2aca1661f490bf3b1.exe

description	pid	process	target process
PID 2752 wrote to memory of 2196	2752	17c0023d45e798a2aca1661f490bf3b1.exe	17c0023d45e798a2aca1661f490bf3b1.exe
PID 2752 wrote to memory of 2196	2752	17c0023d45e798a2aca1661f490bf3b1.exe	17c0023d45e798a2aca1661f490bf3b1.exe
PID 2752 wrote to memory of 2196	2752	17c0023d45e798a2aca1661f490bf3b1.exe	17c0023d45e798a2aca1661f490bf3b1.exe
PID 2752 wrote to memory of 2196	2752	17c0023d45e798a2aca1661f490bf3b1.exe	17c0023d45e798a2aca1661f490bf3b1.exe
PID 2752 wrote to memory of 2196	2752	17c0023d45e798a2aca1661f490bf3b1.exe	17c0023d45e798a2aca1661f490bf3b1.exe
PID 2752 wrote to memory of 2196	2752	17c0023d45e798a2aca1661f490bf3b1.exe	17c0023d45e798a2aca1661f490bf3b1.exe
PID 3040 wrote to memory of 2696	3040		explorer.exe
PID 3040 wrote to memory of 2696	3040		explorer.exe
PID 3040 wrote to memory of 2696	3040		explorer.exe
PID 3040 wrote to memory of 2696	3040		explorer.exe
PID 3040 wrote to memory of 3124	3040		explorer.exe
PID 3040 wrote to memory of 3124	3040		explorer.exe
PID 3040 wrote to memory of 3124	3040		explorer.exe
PID 3040 wrote to memory of 3348	3040		explorer.exe
PID 3040 wrote to memory of 3348	3040		explorer.exe
PID 3040 wrote to memory of 3348	3040		explorer.exe
PID 3040 wrote to memory of 3348	3040		explorer.exe
PID 3040 wrote to memory of 3432	3040		explorer.exe
PID 3040 wrote to memory of 3432	3040		explorer.exe
PID 3040 wrote to memory of 3432	3040		explorer.exe
PID 3040 wrote to memory of 3728	3040		explorer.exe
PID 3040 wrote to memory of 3728	3040		explorer.exe
PID 3040 wrote to memory of 3728	3040		explorer.exe
PID 3040 wrote to memory of 3728	3040		explorer.exe
PID 3040 wrote to memory of 2104	3040		explorer.exe
PID 3040 wrote to memory of 2104	3040		explorer.exe
PID 3040 wrote to memory of 2104	3040		explorer.exe
PID 3040 wrote to memory of 748	3040		explorer.exe
PID 3040 wrote to memory of 748	3040		explorer.exe
PID 3040 wrote to memory of 748	3040		explorer.exe
PID 3040 wrote to memory of 748	3040		explorer.exe
PID 3040 wrote to memory of 1484	3040		explorer.exe
PID 3040 wrote to memory of 1484	3040		explorer.exe
PID 3040 wrote to memory of 1484	3040		explorer.exe
PID 3040 wrote to memory of 3148	3040		explorer.exe
PID 3040 wrote to memory of 3148	3040		explorer.exe
PID 3040 wrote to memory of 3148	3040		explorer.exe
PID 3040 wrote to memory of 3148	3040		explorer.exe

C:\Users\Admin\AppData\Local\Temp\17c0023d45e798a2aca1661f490bf3b1.exe
"C:\Users\Admin\AppData\Local\Temp\17c0023d45e798a2aca1661f490bf3b1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2752

C:\Users\Admin\AppData\Local\Temp\17c0023d45e798a2aca1661f490bf3b1.exe
"C:\Users\Admin\AppData\Local\Temp\17c0023d45e798a2aca1661f490bf3b1.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2196

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2696

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3124

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3348

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3432

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3728

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2104

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:748

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1484

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-138-0x0000000002F20000-0x0000000002F29000-memory.dmp

Filesize
36KB

Download
memory/748-136-0x0000000000000000-mapping.dmp

Download
memory/748-137-0x0000000002F30000-0x0000000002F34000-memory.dmp

Filesize
16KB

Download
memory/1484-141-0x0000000000630000-0x0000000000639000-memory.dmp

Filesize
36KB

Download
memory/1484-140-0x0000000000640000-0x0000000000645000-memory.dmp

Filesize
20KB

Download
memory/1484-139-0x0000000000000000-mapping.dmp

Download
memory/2104-133-0x0000000000000000-mapping.dmp

Download
memory/2104-135-0x0000000000CE0000-0x0000000000CEC000-memory.dmp

Filesize
48KB

Download
memory/2104-134-0x0000000000CF0000-0x0000000000CF6000-memory.dmp

Filesize
24KB

Download
memory/2196-115-0x0000000000402E1A-mapping.dmp

Download
memory/2196-114-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2696-118-0x0000000000000000-mapping.dmp

Download
memory/2696-119-0x0000000002B30000-0x0000000002BA4000-memory.dmp

Filesize
464KB

Download
memory/2696-120-0x0000000002AC0000-0x0000000002B2B000-memory.dmp

Filesize
428KB

Download
memory/2752-116-0x0000000002D50000-0x0000000002E9A000-memory.dmp

Filesize
1.3MB

Download
memory/3040-117-0x0000000001340000-0x0000000001356000-memory.dmp

Filesize
88KB

Download
memory/3124-121-0x0000000000000000-mapping.dmp

Download
memory/3124-123-0x0000000000AB0000-0x0000000000ABC000-memory.dmp

Filesize
48KB

Download
memory/3124-122-0x0000000000AC0000-0x0000000000AC7000-memory.dmp

Filesize
28KB

Download
memory/3148-143-0x0000000002980000-0x0000000002985000-memory.dmp

Filesize
20KB

Download
memory/3148-144-0x0000000002970000-0x0000000002979000-memory.dmp

Filesize
36KB

Download
memory/3148-142-0x0000000000000000-mapping.dmp

Download
memory/3348-125-0x00000000002E0000-0x00000000002E7000-memory.dmp

Filesize
28KB

Download
memory/3348-126-0x00000000002D0000-0x00000000002DB000-memory.dmp

Filesize
44KB

Download
memory/3348-124-0x0000000000000000-mapping.dmp

Download
memory/3432-127-0x0000000000000000-mapping.dmp

Download
memory/3432-128-0x0000000000B40000-0x0000000000B49000-memory.dmp

Filesize
36KB

Download
memory/3432-129-0x0000000000B30000-0x0000000000B3F000-memory.dmp

Filesize
60KB

Download
memory/3728-131-0x00000000032E0000-0x00000000032E5000-memory.dmp

Filesize
20KB

Download
memory/3728-130-0x0000000000000000-mapping.dmp

Download
memory/3728-132-0x00000000032D0000-0x00000000032D9000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads