smokeloader | 88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f

General

Target

88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe
Size

190KB
MD5

ed6aa7c965071baeb9df7d84ba6e10f0
SHA1

5b24b29d033d61f60fb8534d5cb9661022b0a804
SHA256

88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f
SHA512

3c55813abbc24b0aa216d9388251872f2af78569cd98321cd43f244249f80a72b26b504ce8ac07276b17ad535ef3123c60a1c05c7799d276ba0e680581af67bc

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

3000

pid	process
3000

Suspicious use of SetThreadContext 1 IoCs

Processes:

88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe

description	pid	process	target process
PID 2760 set thread context of 1460	2760	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe

pid	process
1460	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe
1460	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3000
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe

pid process

1460 88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe

pid	process
3000

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe

description	pid	process	target process
PID 2760 wrote to memory of 1460	2760	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe
PID 2760 wrote to memory of 1460	2760	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe
PID 2760 wrote to memory of 1460	2760	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe
PID 2760 wrote to memory of 1460	2760	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe
PID 2760 wrote to memory of 1460	2760	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe
PID 2760 wrote to memory of 1460	2760	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe	88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe

C:\Users\Admin\AppData\Local\Temp\88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe
"C:\Users\Admin\AppData\Local\Temp\88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2760

C:\Users\Admin\AppData\Local\Temp\88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe
"C:\Users\Admin\AppData\Local\Temp\88ac4e8fde43cf5c198c3ba80a8c836c256e754d49476c99edb480ece1f5e82f.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-120-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1460-121-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2760-118-0x0000000000610000-0x0000000000634000-memory.dmp

Filesize
144KB

Download
memory/2760-119-0x00000000004D0000-0x000000000061A000-memory.dmp

Filesize
1.3MB

Download
memory/3000-122-0x00000000013E0000-0x00000000013F6000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads