smokeloader | 4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702

General

Target

4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe
Size

333KB
MD5

96caf95b5f2d96dfa8c8c3f398592963
SHA1

29abcb53fb5eff62f6004ed00a9e364b835d3aa4
SHA256

4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702
SHA512

0ac82dfbd2892c532e44792c50d1f12d2ab715506bad267efcd957d58653a0b3c415e235ed1486e0af34bc9a64ba3e2fbc901f9a860a282be8bd8936704c8fec

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

3056

pid	process
3056

Suspicious use of SetThreadContext 1 IoCs

Processes:

4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe

description	pid	process	target process
PID 4016 set thread context of 2504	4016	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe

pid	process
2504	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe
2504	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056
3056

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3056
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe

pid process

2504 4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe

pid	process
3056

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe

description	pid	process	target process
PID 4016 wrote to memory of 2504	4016	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe
PID 4016 wrote to memory of 2504	4016	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe
PID 4016 wrote to memory of 2504	4016	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe
PID 4016 wrote to memory of 2504	4016	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe
PID 4016 wrote to memory of 2504	4016	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe
PID 4016 wrote to memory of 2504	4016	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe	4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe

C:\Users\Admin\AppData\Local\Temp\4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe
"C:\Users\Admin\AppData\Local\Temp\4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4016

C:\Users\Admin\AppData\Local\Temp\4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe
"C:\Users\Admin\AppData\Local\Temp\4d3453493792c05db9b9f018e1f404dd5804c6d54928f0312b667272e8feb702.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2504

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-116-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2504-118-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3056-119-0x00000000005A0000-0x00000000005B6000-memory.dmp

Filesize
88KB

Download
memory/4016-117-0x00000000005A0000-0x00000000005A9000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads