smokeloader | b6a1ce3e1d1dfa3057e7473c9219ba29218014de81c922ad38e96800c1f388e7

Resubmissions

08-11-2021 14:05

211108-rdywgshdbk 10

08-11-2021 13:46

211108-q2zl9ahcgq 10

Analysis

max time kernel
302s
max time network
300s
platform
windows7_x64
resource
win7-ja-20211104
submitted
08-11-2021 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

040d9a95f9e954e29ceb2469fcf3a9e9.exe
Size

228KB
MD5

040d9a95f9e954e29ceb2469fcf3a9e9
SHA1

e04f9f919575e694dc4fe2f7f4646fc3440457b5
SHA256

b6a1ce3e1d1dfa3057e7473c9219ba29218014de81c922ad38e96800c1f388e7
SHA512

6fd2ae969ea6e3184929aa8e04a024432a135523a9508acf0372b2821660df1aace14a97de195101a6f2af0667ad4b7b64b60b3c414cac9a30079485f6bd4669

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://nalirou70.top/

http://xacokuo80.top/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1404
Suspicious use of SetThreadContext 1 IoCs

Processes:

040d9a95f9e954e29ceb2469fcf3a9e9.exe

description pid process target process

PID 700 set thread context of 1272 700 040d9a95f9e954e29ceb2469fcf3a9e9.exe 040d9a95f9e954e29ceb2469fcf3a9e9.exe

pid	process
1404

description	pid	process	target process
PID 700 set thread context of 1272	700	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

040d9a95f9e954e29ceb2469fcf3a9e9.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	040d9a95f9e954e29ceb2469fcf3a9e9.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	040d9a95f9e954e29ceb2469fcf3a9e9.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	040d9a95f9e954e29ceb2469fcf3a9e9.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

040d9a95f9e954e29ceb2469fcf3a9e9.exe

pid	process
1272	040d9a95f9e954e29ceb2469fcf3a9e9.exe
1272	040d9a95f9e954e29ceb2469fcf3a9e9.exe
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1404
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

040d9a95f9e954e29ceb2469fcf3a9e9.exe

pid process

1272 040d9a95f9e954e29ceb2469fcf3a9e9.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 1404
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1404
1404
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1404
1404

pid	process
1404

description	pid	process
Token: SeShutdownPrivilege	1404

pid	process
1404
1404

pid	process
1404
1404

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

040d9a95f9e954e29ceb2469fcf3a9e9.exe

description	pid	process	target process
PID 700 wrote to memory of 1272	700	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 700 wrote to memory of 1272	700	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 700 wrote to memory of 1272	700	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 700 wrote to memory of 1272	700	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 700 wrote to memory of 1272	700	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 700 wrote to memory of 1272	700	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe
PID 700 wrote to memory of 1272	700	040d9a95f9e954e29ceb2469fcf3a9e9.exe	040d9a95f9e954e29ceb2469fcf3a9e9.exe

C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe
"C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:700

C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe
"C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/700-59-0x00000000001C0000-0x00000000001C9000-memory.dmp

Filesize
36KB

Download
memory/700-58-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/1272-56-0x0000000000402DC6-mapping.dmp

Download
memory/1272-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1272-57-0x0000000075B71000-0x0000000075B73000-memory.dmp

Filesize
8KB

Download
memory/1404-60-0x0000000002680000-0x0000000002696000-memory.dmp

Filesize
88KB

Download