smokeloader | afd96a8e1fd8b41cf41130c5b9055f96209acdb7aa4c31f8f1091b5ee775c96b

General

Target

6d8672cdfdbf8a4a73699d582f5e81c0.exe
Size

318KB
MD5

6d8672cdfdbf8a4a73699d582f5e81c0
SHA1

39199f6f7fefc069d3dc3d8244b735e25eec9abe
SHA256

afd96a8e1fd8b41cf41130c5b9055f96209acdb7aa4c31f8f1091b5ee775c96b
SHA512

b69593c7a94e3e2008845b8bf0421feb7c6ad6022c8def74e9ef0df4b02fb09d6343bb49fadc416240b81557a024823beb5ab34843e234fdb369ac2b1f258c14

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

A64D.exeFED9.exe38C.exeFED9.exe

pid process

2000 A64D.exe
1880 FED9.exe
1716 38C.exe
1672 FED9.exe
Deletes itself 1 IoCs

Processes:

pid process

1248
Loads dropped DLL 1 IoCs

Processes:

FED9.exe

pid process

1880 FED9.exe

pid	process
2000	A64D.exe
1880	FED9.exe
1716	38C.exe
1672	FED9.exe

pid	process
1248

pid	process
1880	FED9.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

6d8672cdfdbf8a4a73699d582f5e81c0.exeFED9.exe

description	pid	process	target process
PID 1896 set thread context of 476	1896	6d8672cdfdbf8a4a73699d582f5e81c0.exe	6d8672cdfdbf8a4a73699d582f5e81c0.exe
PID 1880 set thread context of 1672	1880	FED9.exe	FED9.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

FED9.exe6d8672cdfdbf8a4a73699d582f5e81c0.exeA64D.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	FED9.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	FED9.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6d8672cdfdbf8a4a73699d582f5e81c0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6d8672cdfdbf8a4a73699d582f5e81c0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A64D.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A64D.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	FED9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6d8672cdfdbf8a4a73699d582f5e81c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A64D.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6d8672cdfdbf8a4a73699d582f5e81c0.exe

pid	process
476	6d8672cdfdbf8a4a73699d582f5e81c0.exe
476	6d8672cdfdbf8a4a73699d582f5e81c0.exe
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1248
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

6d8672cdfdbf8a4a73699d582f5e81c0.exeA64D.exe

pid process

476 6d8672cdfdbf8a4a73699d582f5e81c0.exe
2000 A64D.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1248
1248
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1248
1248

pid	process
1248

pid	process
1248
1248

pid	process
1248
1248

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

6d8672cdfdbf8a4a73699d582f5e81c0.exeFED9.exe

description	pid	process	target process
PID 1896 wrote to memory of 476	1896	6d8672cdfdbf8a4a73699d582f5e81c0.exe	6d8672cdfdbf8a4a73699d582f5e81c0.exe
PID 1896 wrote to memory of 476	1896	6d8672cdfdbf8a4a73699d582f5e81c0.exe	6d8672cdfdbf8a4a73699d582f5e81c0.exe
PID 1896 wrote to memory of 476	1896	6d8672cdfdbf8a4a73699d582f5e81c0.exe	6d8672cdfdbf8a4a73699d582f5e81c0.exe
PID 1896 wrote to memory of 476	1896	6d8672cdfdbf8a4a73699d582f5e81c0.exe	6d8672cdfdbf8a4a73699d582f5e81c0.exe
PID 1896 wrote to memory of 476	1896	6d8672cdfdbf8a4a73699d582f5e81c0.exe	6d8672cdfdbf8a4a73699d582f5e81c0.exe
PID 1896 wrote to memory of 476	1896	6d8672cdfdbf8a4a73699d582f5e81c0.exe	6d8672cdfdbf8a4a73699d582f5e81c0.exe
PID 1896 wrote to memory of 476	1896	6d8672cdfdbf8a4a73699d582f5e81c0.exe	6d8672cdfdbf8a4a73699d582f5e81c0.exe
PID 1248 wrote to memory of 2000	1248		A64D.exe
PID 1248 wrote to memory of 2000	1248		A64D.exe
PID 1248 wrote to memory of 2000	1248		A64D.exe
PID 1248 wrote to memory of 2000	1248		A64D.exe
PID 1248 wrote to memory of 1880	1248		FED9.exe
PID 1248 wrote to memory of 1880	1248		FED9.exe
PID 1248 wrote to memory of 1880	1248		FED9.exe
PID 1248 wrote to memory of 1880	1248		FED9.exe
PID 1248 wrote to memory of 1716	1248		38C.exe
PID 1248 wrote to memory of 1716	1248		38C.exe
PID 1248 wrote to memory of 1716	1248		38C.exe
PID 1248 wrote to memory of 1716	1248		38C.exe
PID 1880 wrote to memory of 1672	1880	FED9.exe	FED9.exe
PID 1880 wrote to memory of 1672	1880	FED9.exe	FED9.exe
PID 1880 wrote to memory of 1672	1880	FED9.exe	FED9.exe
PID 1880 wrote to memory of 1672	1880	FED9.exe	FED9.exe
PID 1880 wrote to memory of 1672	1880	FED9.exe	FED9.exe
PID 1880 wrote to memory of 1672	1880	FED9.exe	FED9.exe
PID 1880 wrote to memory of 1672	1880	FED9.exe	FED9.exe

C:\Users\Admin\AppData\Local\Temp\6d8672cdfdbf8a4a73699d582f5e81c0.exe
"C:\Users\Admin\AppData\Local\Temp\6d8672cdfdbf8a4a73699d582f5e81c0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1896

C:\Users\Admin\AppData\Local\Temp\6d8672cdfdbf8a4a73699d582f5e81c0.exe
"C:\Users\Admin\AppData\Local\Temp\6d8672cdfdbf8a4a73699d582f5e81c0.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:476

C:\Users\Admin\AppData\Local\Temp\A64D.exe
C:\Users\Admin\AppData\Local\Temp\A64D.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2000

C:\Users\Admin\AppData\Local\Temp\FED9.exe
C:\Users\Admin\AppData\Local\Temp\FED9.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1880

C:\Users\Admin\AppData\Local\Temp\FED9.exe
C:\Users\Admin\AppData\Local\Temp\FED9.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1672

C:\Users\Admin\AppData\Local\Temp\38C.exe
C:\Users\Admin\AppData\Local\Temp\38C.exe
1⤵
- Executes dropped EXE
PID:1716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\38C.exe
MD5
61a3807e15231687f38358e3ae6b670c

SHA1
b577ef08f60b55811aa5b8b93e5b3755b899115f

SHA256
56283f214f84bf23a55813990e2147767f71a61c6158ed1e5e9178527a6f90f1

SHA512
8dfe85f3779d08a083e6be58d8ea9638daa1fe03716e1a8a88ab9be90cd9fa03a6c05c8e7e6ab37a2d729fe422c8a280133ea4cc2820d140a71b6eb78231b9f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\A64D.exe
MD5
df13fac0d8b182e4d8b9a02ba87a9571

SHA1
b2187debc6fde96e08d5014ce4f1af5cf568bce5

SHA256
af64f5b2b6c4cc63b0ca4bb48f369eba1629886d85e289a469a5c9612c4a5ee3

SHA512
bc842a80509bda8afff6e12f5b5c64ccf7f1d7360f99f63cebbc1f21936a15487ec16bde3c2acff22c49ebcedf5c426621d6f69503f4968aacc8e75611e3a816

Download Submit
C:\Users\Admin\AppData\Local\Temp\FED9.exe
MD5
abc129961e3bf1a860d06d098650086b

SHA1
2abfd118d815b6986da344ea8153f39193f7eea2

SHA256
12a3a8e92cab5c40d73db1670eea5e97f84d1ba4e6af723e4c2ee8f4cf6323fa

SHA512
04a5ff61a6b558385648686065afdc3b18a20e1381d2e923093ca22a777a439b3669da5552185a803b1535540dc888896c9783451664d3f2f47e3d736826ae53

Download Submit
C:\Users\Admin\AppData\Local\Temp\FED9.exe
MD5
abc129961e3bf1a860d06d098650086b

SHA1
2abfd118d815b6986da344ea8153f39193f7eea2

SHA256
12a3a8e92cab5c40d73db1670eea5e97f84d1ba4e6af723e4c2ee8f4cf6323fa

SHA512
04a5ff61a6b558385648686065afdc3b18a20e1381d2e923093ca22a777a439b3669da5552185a803b1535540dc888896c9783451664d3f2f47e3d736826ae53

Download Submit
C:\Users\Admin\AppData\Local\Temp\FED9.exe
MD5
abc129961e3bf1a860d06d098650086b

SHA1
2abfd118d815b6986da344ea8153f39193f7eea2

SHA256
12a3a8e92cab5c40d73db1670eea5e97f84d1ba4e6af723e4c2ee8f4cf6323fa

SHA512
04a5ff61a6b558385648686065afdc3b18a20e1381d2e923093ca22a777a439b3669da5552185a803b1535540dc888896c9783451664d3f2f47e3d736826ae53

Download Submit
\Users\Admin\AppData\Local\Temp\FED9.exe
MD5
abc129961e3bf1a860d06d098650086b

SHA1
2abfd118d815b6986da344ea8153f39193f7eea2

SHA256
12a3a8e92cab5c40d73db1670eea5e97f84d1ba4e6af723e4c2ee8f4cf6323fa

SHA512
04a5ff61a6b558385648686065afdc3b18a20e1381d2e923093ca22a777a439b3669da5552185a803b1535540dc888896c9783451664d3f2f47e3d736826ae53

Download Submit
memory/476-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/476-57-0x0000000000402F47-mapping.dmp

Download
memory/476-58-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1248-60-0x00000000029D0000-0x00000000029E6000-memory.dmp

Filesize
88KB

Download
memory/1248-67-0x0000000002CF0000-0x0000000002D06000-memory.dmp

Filesize
88KB

Download
memory/1672-76-0x0000000000402F47-mapping.dmp

Download
memory/1716-70-0x0000000000000000-mapping.dmp

Download
memory/1880-68-0x0000000000000000-mapping.dmp

Download
memory/1880-72-0x00000000005FB000-0x0000000000604000-memory.dmp

Filesize
36KB

Download
memory/1896-55-0x00000000002C8000-0x00000000002D9000-memory.dmp

Filesize
68KB

Download
memory/1896-59-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/2000-66-0x0000000000400000-0x0000000002B64000-memory.dmp

Filesize
39.4MB

Download
memory/2000-65-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/2000-64-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2000-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads