smokeloader | 448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec

General

Target

448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe
Size

264KB
MD5

08f9bea57c5f3354f37bfb354468f66e
SHA1

7ccc45f69f10b5c8359f4b8622d4be455d605f41
SHA256

448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec
SHA512

e44d0d92270c21dffae70a50cfc25cf4686c6c32d4cfe06d1287e7670fc9c6c3daba7250aaad9753264a6ca7aeea49c60e8d8e9127b7c0048ffcc7ed856257cc

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1928

pid	process
1928

Suspicious use of SetThreadContext 1 IoCs

Processes:

448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe

description	pid	process	target process
PID 2656 set thread context of 1368	2656	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe

pid	process
1368	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe
1368	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928
1928

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1928
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe

pid process

1368 448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe

pid	process
1928

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe

description	pid	process	target process
PID 2656 wrote to memory of 1368	2656	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe
PID 2656 wrote to memory of 1368	2656	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe
PID 2656 wrote to memory of 1368	2656	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe
PID 2656 wrote to memory of 1368	2656	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe
PID 2656 wrote to memory of 1368	2656	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe
PID 2656 wrote to memory of 1368	2656	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe	448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe

C:\Users\Admin\AppData\Local\Temp\448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe
"C:\Users\Admin\AppData\Local\Temp\448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2656

C:\Users\Admin\AppData\Local\Temp\448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe
"C:\Users\Admin\AppData\Local\Temp\448bfa5b494cd4b1cfbe4a3e493aa5cbe4ac7e7980608e688f394045d61963ec.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-120-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1368-121-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1928-122-0x0000000000860000-0x0000000000876000-memory.dmp

Filesize
88KB

Download
memory/2656-118-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/2656-119-0x0000000000450000-0x000000000059A000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads