smokeloader | b05db7d981c801133dc78063c7febe2b3d66482af17e732e6a9908aba8bfe8dd

General

Target

0308227d1c11472ccbde6b9fc35ed19a.exe
Size

263KB
MD5

0308227d1c11472ccbde6b9fc35ed19a
SHA1

f46d200edbe9ad124cf1c1281463de772a4c0379
SHA256

b05db7d981c801133dc78063c7febe2b3d66482af17e732e6a9908aba8bfe8dd
SHA512

9a6f2ec85a27c2bee1aa6b3bb1b33415ddae93a949c67abbe9f8e21a12c1d67e73b64766e7049f219dbe23170233deb876fc7cf3c93641251893e00820c56174

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

80E3.exe80E3.exeAF44.exe

pid process

688 80E3.exe
336 80E3.exe
1912 AF44.exe
Deletes itself 1 IoCs

Processes:

pid process

1200
Loads dropped DLL 1 IoCs

Processes:

80E3.exe

pid process

688 80E3.exe

pid	process
688	80E3.exe
336	80E3.exe
1912	AF44.exe

pid	process
1200

pid	process
688	80E3.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

0308227d1c11472ccbde6b9fc35ed19a.exe80E3.exe

description	pid	process	target process
PID 1336 set thread context of 1060	1336	0308227d1c11472ccbde6b9fc35ed19a.exe	0308227d1c11472ccbde6b9fc35ed19a.exe
PID 688 set thread context of 336	688	80E3.exe	80E3.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0308227d1c11472ccbde6b9fc35ed19a.exe80E3.exeAF44.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0308227d1c11472ccbde6b9fc35ed19a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	80E3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	80E3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AF44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0308227d1c11472ccbde6b9fc35ed19a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0308227d1c11472ccbde6b9fc35ed19a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	80E3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AF44.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AF44.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0308227d1c11472ccbde6b9fc35ed19a.exe

pid	process
1060	0308227d1c11472ccbde6b9fc35ed19a.exe
1060	0308227d1c11472ccbde6b9fc35ed19a.exe
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1200
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

0308227d1c11472ccbde6b9fc35ed19a.exe80E3.exeAF44.exe

pid process

1060 0308227d1c11472ccbde6b9fc35ed19a.exe
336 80E3.exe
1912 AF44.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1200
1200
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1200
1200

pid	process
1200

pid	process
1200
1200

pid	process
1200
1200

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

0308227d1c11472ccbde6b9fc35ed19a.exe80E3.exe

description	pid	process	target process
PID 1336 wrote to memory of 1060	1336	0308227d1c11472ccbde6b9fc35ed19a.exe	0308227d1c11472ccbde6b9fc35ed19a.exe
PID 1336 wrote to memory of 1060	1336	0308227d1c11472ccbde6b9fc35ed19a.exe	0308227d1c11472ccbde6b9fc35ed19a.exe
PID 1336 wrote to memory of 1060	1336	0308227d1c11472ccbde6b9fc35ed19a.exe	0308227d1c11472ccbde6b9fc35ed19a.exe
PID 1336 wrote to memory of 1060	1336	0308227d1c11472ccbde6b9fc35ed19a.exe	0308227d1c11472ccbde6b9fc35ed19a.exe
PID 1336 wrote to memory of 1060	1336	0308227d1c11472ccbde6b9fc35ed19a.exe	0308227d1c11472ccbde6b9fc35ed19a.exe
PID 1336 wrote to memory of 1060	1336	0308227d1c11472ccbde6b9fc35ed19a.exe	0308227d1c11472ccbde6b9fc35ed19a.exe
PID 1336 wrote to memory of 1060	1336	0308227d1c11472ccbde6b9fc35ed19a.exe	0308227d1c11472ccbde6b9fc35ed19a.exe
PID 1200 wrote to memory of 688	1200		80E3.exe
PID 1200 wrote to memory of 688	1200		80E3.exe
PID 1200 wrote to memory of 688	1200		80E3.exe
PID 1200 wrote to memory of 688	1200		80E3.exe
PID 688 wrote to memory of 336	688	80E3.exe	80E3.exe
PID 688 wrote to memory of 336	688	80E3.exe	80E3.exe
PID 688 wrote to memory of 336	688	80E3.exe	80E3.exe
PID 688 wrote to memory of 336	688	80E3.exe	80E3.exe
PID 688 wrote to memory of 336	688	80E3.exe	80E3.exe
PID 688 wrote to memory of 336	688	80E3.exe	80E3.exe
PID 688 wrote to memory of 336	688	80E3.exe	80E3.exe
PID 1200 wrote to memory of 1912	1200		AF44.exe
PID 1200 wrote to memory of 1912	1200		AF44.exe
PID 1200 wrote to memory of 1912	1200		AF44.exe
PID 1200 wrote to memory of 1912	1200		AF44.exe

C:\Users\Admin\AppData\Local\Temp\0308227d1c11472ccbde6b9fc35ed19a.exe
"C:\Users\Admin\AppData\Local\Temp\0308227d1c11472ccbde6b9fc35ed19a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1336

C:\Users\Admin\AppData\Local\Temp\0308227d1c11472ccbde6b9fc35ed19a.exe
"C:\Users\Admin\AppData\Local\Temp\0308227d1c11472ccbde6b9fc35ed19a.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1060

C:\Users\Admin\AppData\Local\Temp\80E3.exe
C:\Users\Admin\AppData\Local\Temp\80E3.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:688

C:\Users\Admin\AppData\Local\Temp\80E3.exe
C:\Users\Admin\AppData\Local\Temp\80E3.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:336

C:\Users\Admin\AppData\Local\Temp\AF44.exe
C:\Users\Admin\AppData\Local\Temp\AF44.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\80E3.exe
MD5
0308227d1c11472ccbde6b9fc35ed19a

SHA1
f46d200edbe9ad124cf1c1281463de772a4c0379

SHA256
b05db7d981c801133dc78063c7febe2b3d66482af17e732e6a9908aba8bfe8dd

SHA512
9a6f2ec85a27c2bee1aa6b3bb1b33415ddae93a949c67abbe9f8e21a12c1d67e73b64766e7049f219dbe23170233deb876fc7cf3c93641251893e00820c56174

Download Submit
C:\Users\Admin\AppData\Local\Temp\80E3.exe
MD5
0308227d1c11472ccbde6b9fc35ed19a

SHA1
f46d200edbe9ad124cf1c1281463de772a4c0379

SHA256
b05db7d981c801133dc78063c7febe2b3d66482af17e732e6a9908aba8bfe8dd

SHA512
9a6f2ec85a27c2bee1aa6b3bb1b33415ddae93a949c67abbe9f8e21a12c1d67e73b64766e7049f219dbe23170233deb876fc7cf3c93641251893e00820c56174

Download Submit
C:\Users\Admin\AppData\Local\Temp\80E3.exe
MD5
0308227d1c11472ccbde6b9fc35ed19a

SHA1
f46d200edbe9ad124cf1c1281463de772a4c0379

SHA256
b05db7d981c801133dc78063c7febe2b3d66482af17e732e6a9908aba8bfe8dd

SHA512
9a6f2ec85a27c2bee1aa6b3bb1b33415ddae93a949c67abbe9f8e21a12c1d67e73b64766e7049f219dbe23170233deb876fc7cf3c93641251893e00820c56174

Download Submit
C:\Users\Admin\AppData\Local\Temp\AF44.exe
MD5
df13fac0d8b182e4d8b9a02ba87a9571

SHA1
b2187debc6fde96e08d5014ce4f1af5cf568bce5

SHA256
af64f5b2b6c4cc63b0ca4bb48f369eba1629886d85e289a469a5c9612c4a5ee3

SHA512
bc842a80509bda8afff6e12f5b5c64ccf7f1d7360f99f63cebbc1f21936a15487ec16bde3c2acff22c49ebcedf5c426621d6f69503f4968aacc8e75611e3a816

Download Submit
\Users\Admin\AppData\Local\Temp\80E3.exe
MD5
0308227d1c11472ccbde6b9fc35ed19a

SHA1
f46d200edbe9ad124cf1c1281463de772a4c0379

SHA256
b05db7d981c801133dc78063c7febe2b3d66482af17e732e6a9908aba8bfe8dd

SHA512
9a6f2ec85a27c2bee1aa6b3bb1b33415ddae93a949c67abbe9f8e21a12c1d67e73b64766e7049f219dbe23170233deb876fc7cf3c93641251893e00820c56174

Download Submit
memory/336-67-0x0000000000402F47-mapping.dmp

Download
memory/688-63-0x000000000056B000-0x0000000000574000-memory.dmp

Filesize
36KB

Download
memory/688-61-0x0000000000000000-mapping.dmp

Download
memory/1060-57-0x0000000000402F47-mapping.dmp

Download
memory/1060-58-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1060-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1200-70-0x00000000038C0000-0x00000000038D6000-memory.dmp

Filesize
88KB

Download
memory/1200-60-0x0000000002210000-0x0000000002226000-memory.dmp

Filesize
88KB

Download
memory/1200-77-0x0000000003E40000-0x0000000003E56000-memory.dmp

Filesize
88KB

Download
memory/1336-59-0x00000000001B0000-0x00000000001B9000-memory.dmp

Filesize
36KB

Download
memory/1336-55-0x00000000002CB000-0x00000000002D4000-memory.dmp

Filesize
36KB

Download
memory/1912-71-0x0000000000000000-mapping.dmp

Download
memory/1912-74-0x00000000002B0000-0x00000000002B9000-memory.dmp

Filesize
36KB

Download
memory/1912-75-0x00000000002C0000-0x00000000002C9000-memory.dmp

Filesize
36KB

Download
memory/1912-76-0x0000000000400000-0x0000000002B64000-memory.dmp

Filesize
39.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads