smokeloader | 2d0bd38ea59864cdcd710759abea3f670449eb4505b54c8a8d22128691deefc1

Resubmissions

09-01-2022 14:33

220109-rwxq5sdhcr 10

09-01-2022 14:06

220109-rejg7aded7 10

09-01-2022 08:20

220109-j8fz6addd9 10

Analysis

max time kernel
151s
max time network
149s
platform
windows7_x64
resource
win7-en-20211208
submitted
09-01-2022 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59ddabdcb5b43bbc66bbec89123d2627.exe
Size

265KB
MD5

59ddabdcb5b43bbc66bbec89123d2627
SHA1

6c33dde51d6b45319ad99408c10f6ad8b1340e2f
SHA256

2d0bd38ea59864cdcd710759abea3f670449eb4505b54c8a8d22128691deefc1
SHA512

56463528dc37c141519535140a24d0ce02ca2227ef8c302494e422109e5d6b83a5d6ac5f2b698838e29661cd9dd986d9a2dc0f7c3c4f025f5283cebca052b8b3

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://nahbleiben.at/upload/

http://noblecreativeaz.com/upload/

http://tvqaq.cn/upload/

http://recmaster.ru/upload/

http://sovels.ru/upload/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

D46F.exeF26B.exe

pid process

1208 D46F.exe
1200 F26B.exe
Deletes itself 1 IoCs

Processes:

pid process

1404

pid	process
1208	D46F.exe
1200	F26B.exe

pid	process
1404

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

59ddabdcb5b43bbc66bbec89123d2627.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	59ddabdcb5b43bbc66bbec89123d2627.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	59ddabdcb5b43bbc66bbec89123d2627.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	59ddabdcb5b43bbc66bbec89123d2627.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

59ddabdcb5b43bbc66bbec89123d2627.exe

pid	process
1584	59ddabdcb5b43bbc66bbec89123d2627.exe
1584	59ddabdcb5b43bbc66bbec89123d2627.exe
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404
1404

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1404
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

59ddabdcb5b43bbc66bbec89123d2627.exe

pid process

1584 59ddabdcb5b43bbc66bbec89123d2627.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1404
1404
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1404
1404

pid	process
1404

pid	process
1404
1404

pid	process
1404
1404

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

description	pid	target process
PID 1404 wrote to memory of 1208	1404	D46F.exe
PID 1404 wrote to memory of 1208	1404	D46F.exe
PID 1404 wrote to memory of 1208	1404	D46F.exe
PID 1404 wrote to memory of 1208	1404	D46F.exe
PID 1404 wrote to memory of 1200	1404	F26B.exe
PID 1404 wrote to memory of 1200	1404	F26B.exe
PID 1404 wrote to memory of 1200	1404	F26B.exe
PID 1404 wrote to memory of 1200	1404	F26B.exe

C:\Users\Admin\AppData\Local\Temp\59ddabdcb5b43bbc66bbec89123d2627.exe
"C:\Users\Admin\AppData\Local\Temp\59ddabdcb5b43bbc66bbec89123d2627.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1584

C:\Users\Admin\AppData\Local\Temp\D46F.exe
C:\Users\Admin\AppData\Local\Temp\D46F.exe
1⤵
- Executes dropped EXE
PID:1208

C:\Users\Admin\AppData\Local\Temp\F26B.exe
C:\Users\Admin\AppData\Local\Temp\F26B.exe
1⤵
- Executes dropped EXE
PID:1200

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D46F.exe
MD5
f601ad405d65674d3fdd6d9625770487

SHA1
2d5a12ef12b560d3bb634fa37d78951169113949

SHA256
2a009cecbb0b5f61ac6956e12a8ffd880a5c6c5fcce207d48a39dec829daff6d

SHA512
1347e26b67ed12d3173196aaca8e9fcad5bb8f6ed17e0482c5b5e33ddbecb19b954d46fcea4ff9e07e7d116b2c3ba351a1ce3aae294e4ce9e176797115a8171f

Download Submit
C:\Users\Admin\AppData\Local\Temp\F26B.exe
MD5
f601ad405d65674d3fdd6d9625770487

SHA1
2d5a12ef12b560d3bb634fa37d78951169113949

SHA256
2a009cecbb0b5f61ac6956e12a8ffd880a5c6c5fcce207d48a39dec829daff6d

SHA512
1347e26b67ed12d3173196aaca8e9fcad5bb8f6ed17e0482c5b5e33ddbecb19b954d46fcea4ff9e07e7d116b2c3ba351a1ce3aae294e4ce9e176797115a8171f

Download Submit
memory/1200-68-0x0000000000400000-0x0000000002C54000-memory.dmp

Filesize
40.3MB

Download
memory/1200-61-0x0000000000000000-mapping.dmp

Download
memory/1208-65-0x0000000004760000-0x000000000485C000-memory.dmp

Filesize
1008KB

Download
memory/1208-59-0x0000000000000000-mapping.dmp

Download
memory/1208-64-0x0000000004670000-0x0000000004754000-memory.dmp

Filesize
912KB

Download
memory/1208-66-0x0000000000400000-0x0000000002C54000-memory.dmp

Filesize
40.3MB

Download
memory/1404-58-0x0000000002600000-0x0000000002616000-memory.dmp

Filesize
88KB

Download
memory/1584-57-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/1584-55-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1584-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1584-56-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download