smokeloader | 0a450a95653d5538130a1ee5ba705d79c909759477d51e5955ffa6663b68dc5c

General

Target

eufive_20210923-211502.exe
Size

119KB
MD5

35283c334f846ccb26e3de1061c7d43e
SHA1

64041989bf55e8039fa324611c9ee4b0bd6389aa
SHA256

0a450a95653d5538130a1ee5ba705d79c909759477d51e5955ffa6663b68dc5c
SHA512

5126e839378abdec91681027b2f84cbc4ce9769e70b3e12443612017a4fb59cd8cf5c24923ba560b9a82ca7f3cad5cb0374bb9afa932ba862a2cbbb3a88db0ff

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://sokdikksiiefgsdf.cyou/

https://sokdikksiiefgsdf.cyou/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1204

pid	process
1204

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

eufive_20210923-211502.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eufive_20210923-211502.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eufive_20210923-211502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eufive_20210923-211502.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

eufive_20210923-211502.exe

pid	process
1428	eufive_20210923-211502.exe
1428	eufive_20210923-211502.exe
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1204
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

eufive_20210923-211502.exe

pid process

1428 eufive_20210923-211502.exe
1204
1204
1204
1204
1204
1204
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

pid process

1204
1204
1204
1204
1204
1204
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

pid process

1204
1204
1204
1204
1204
1204

pid	process
1204

pid	process
1204
1204
1204
1204
1204
1204

pid	process
1204
1204
1204
1204
1204
1204

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

description	pid	target process
PID 1204 wrote to memory of 980	1204	explorer.exe
PID 1204 wrote to memory of 980	1204	explorer.exe
PID 1204 wrote to memory of 980	1204	explorer.exe
PID 1204 wrote to memory of 980	1204	explorer.exe
PID 1204 wrote to memory of 980	1204	explorer.exe
PID 1204 wrote to memory of 1328	1204	explorer.exe
PID 1204 wrote to memory of 1328	1204	explorer.exe
PID 1204 wrote to memory of 1328	1204	explorer.exe
PID 1204 wrote to memory of 1328	1204	explorer.exe
PID 1204 wrote to memory of 1700	1204	explorer.exe
PID 1204 wrote to memory of 1700	1204	explorer.exe
PID 1204 wrote to memory of 1700	1204	explorer.exe
PID 1204 wrote to memory of 1700	1204	explorer.exe
PID 1204 wrote to memory of 1700	1204	explorer.exe

C:\Users\Admin\AppData\Local\Temp\eufive_20210923-211502.exe
"C:\Users\Admin\AppData\Local\Temp\eufive_20210923-211502.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1428

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:980

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1328

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-60-0x00000000750E1000-0x00000000750E3000-memory.dmp

Filesize
8KB

Download
memory/980-63-0x00000000000D0000-0x000000000013B000-memory.dmp

Filesize
428KB

Download
memory/980-62-0x00000000001E0000-0x0000000000254000-memory.dmp

Filesize
464KB

Download
memory/980-58-0x0000000000000000-mapping.dmp

Download
memory/1204-57-0x0000000002920000-0x0000000002935000-memory.dmp

Filesize
84KB

Download
memory/1328-61-0x0000000000000000-mapping.dmp

Download
memory/1328-65-0x0000000000060000-0x000000000006C000-memory.dmp

Filesize
48KB

Download
memory/1328-64-0x0000000000070000-0x0000000000077000-memory.dmp

Filesize
28KB

Download
memory/1428-54-0x00000000768C1000-0x00000000768C3000-memory.dmp

Filesize
8KB

Download
memory/1428-55-0x00000000001B0000-0x00000000001B9000-memory.dmp

Filesize
36KB

Download
memory/1428-56-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1700-66-0x0000000000000000-mapping.dmp

Download
memory/1700-68-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1700-69-0x0000000000090000-0x0000000000098000-memory.dmp

Filesize
32KB

Download
memory/1700-70-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads