smokeloader | 61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91

General

Target

61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe
Size

317KB
MD5

827657a25805cd47b4d8c3fc04f3605c
SHA1

9813e4e80ca00667706dad344985a5d45513d627
SHA256

61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91
SHA512

c0e5292ea34de1a99122cd66a6cd268137b67cb81dbdf439c60d7d42caae1402f8bd93729011929566ddddc5bb76c1dca8d77fa248091dc499791a8d4cf376dc

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

2712

pid	process
2712

Suspicious use of SetThreadContext 1 IoCs

Processes:

61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe

description	pid	process	target process
PID 3972 set thread context of 1276	3972	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe

pid	process
1276	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe
1276	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712
2712

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2712
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe

pid process

1276 61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe

pid	process
2712

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe

description	pid	process	target process
PID 3972 wrote to memory of 1276	3972	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe
PID 3972 wrote to memory of 1276	3972	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe
PID 3972 wrote to memory of 1276	3972	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe
PID 3972 wrote to memory of 1276	3972	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe
PID 3972 wrote to memory of 1276	3972	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe
PID 3972 wrote to memory of 1276	3972	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe	61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe

C:\Users\Admin\AppData\Local\Temp\61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe
"C:\Users\Admin\AppData\Local\Temp\61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3972

C:\Users\Admin\AppData\Local\Temp\61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe
"C:\Users\Admin\AppData\Local\Temp\61b5a93881dd96c7997143e3b79bf888adfbb03796da0cbf4db01a55eddb0d91.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-115-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1276-117-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2712-118-0x0000000000710000-0x0000000000726000-memory.dmp

Filesize
88KB

Download
memory/3972-116-0x0000000000030000-0x0000000000038000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads