smokeloader | 5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840

General

Target

5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
Size

241KB
MD5

95fd5db1e1529ff4369fe2619d99832f
SHA1

82caa7406ac895b7da1c9d2461df77506e42cb47
SHA256

5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840
SHA512

29fed18b500f7c9d3b1fdb372d8d523f8a6f4e3527f4e021ab44319d9b523720206d8c148590378fe955488c3e8cb14c5e73c07aabca9e5415295a36f655a172

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 2 IoCs

Processes:

cfsgdsicfsgdsi

pid process

584 cfsgdsi
1516 cfsgdsi
Deletes itself 1 IoCs

Processes:

pid process

1880

pid	process
584	cfsgdsi
1516	cfsgdsi

pid	process
1880

Suspicious use of SetThreadContext 2 IoCs

Processes:

5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.execfsgdsi

description	pid	process	target process
PID 2224 set thread context of 2736	2224	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
PID 584 set thread context of 1516	584	cfsgdsi	cfsgdsi

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cfsgdsi5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cfsgdsi
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cfsgdsi
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cfsgdsi

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe

pid	process
2736	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
2736	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880
1880

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1880
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.execfsgdsi

pid process

2736 5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
1516 cfsgdsi
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 1880
Token: SeCreatePagefilePrivilege 1880

pid	process
1880

description	pid	process
Token: SeShutdownPrivilege	1880
Token: SeCreatePagefilePrivilege	1880

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.execfsgdsi

description	pid	process	target process
PID 2224 wrote to memory of 2736	2224	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
PID 2224 wrote to memory of 2736	2224	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
PID 2224 wrote to memory of 2736	2224	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
PID 2224 wrote to memory of 2736	2224	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
PID 2224 wrote to memory of 2736	2224	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
PID 2224 wrote to memory of 2736	2224	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe	5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
PID 584 wrote to memory of 1516	584	cfsgdsi	cfsgdsi
PID 584 wrote to memory of 1516	584	cfsgdsi	cfsgdsi
PID 584 wrote to memory of 1516	584	cfsgdsi	cfsgdsi
PID 584 wrote to memory of 1516	584	cfsgdsi	cfsgdsi
PID 584 wrote to memory of 1516	584	cfsgdsi	cfsgdsi
PID 584 wrote to memory of 1516	584	cfsgdsi	cfsgdsi

C:\Users\Admin\AppData\Local\Temp\5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
"C:\Users\Admin\AppData\Local\Temp\5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2224

C:\Users\Admin\AppData\Local\Temp\5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe
"C:\Users\Admin\AppData\Local\Temp\5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2736

C:\Users\Admin\AppData\Roaming\cfsgdsi
C:\Users\Admin\AppData\Roaming\cfsgdsi
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:584

C:\Users\Admin\AppData\Roaming\cfsgdsi
C:\Users\Admin\AppData\Roaming\cfsgdsi
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\cfsgdsi
MD5
95fd5db1e1529ff4369fe2619d99832f

SHA1
82caa7406ac895b7da1c9d2461df77506e42cb47

SHA256
5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840

SHA512
29fed18b500f7c9d3b1fdb372d8d523f8a6f4e3527f4e021ab44319d9b523720206d8c148590378fe955488c3e8cb14c5e73c07aabca9e5415295a36f655a172

Download Submit
C:\Users\Admin\AppData\Roaming\cfsgdsi
MD5
95fd5db1e1529ff4369fe2619d99832f

SHA1
82caa7406ac895b7da1c9d2461df77506e42cb47

SHA256
5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840

SHA512
29fed18b500f7c9d3b1fdb372d8d523f8a6f4e3527f4e021ab44319d9b523720206d8c148590378fe955488c3e8cb14c5e73c07aabca9e5415295a36f655a172

Download Submit
C:\Users\Admin\AppData\Roaming\cfsgdsi
MD5
95fd5db1e1529ff4369fe2619d99832f

SHA1
82caa7406ac895b7da1c9d2461df77506e42cb47

SHA256
5753b2cfe4fc0704fced8154c3d7e566c6e0f58c2d1e55fcf6364421a5ee6840

SHA512
29fed18b500f7c9d3b1fdb372d8d523f8a6f4e3527f4e021ab44319d9b523720206d8c148590378fe955488c3e8cb14c5e73c07aabca9e5415295a36f655a172

Download Submit
memory/584-125-0x00000000004A0000-0x00000000004A9000-memory.dmp

Filesize
36KB

Download
memory/1516-126-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1880-119-0x0000000000660000-0x0000000000676000-memory.dmp

Filesize
88KB

Download
memory/1880-127-0x00000000006B0000-0x00000000006C6000-memory.dmp

Filesize
88KB

Download
memory/2224-116-0x0000000000450000-0x00000000004FE000-memory.dmp

Filesize
696KB

Download
memory/2736-117-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2736-118-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads