smokeloader | 9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f

General

Target

9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe
Size

352KB
MD5

0e62d19d082ca9604e0e4ef5d39a53c2
SHA1

a54a265f44431d9804ce871812d1047e08a7d945
SHA256

9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f
SHA512

d5123d1367745183a6bdf521a5601620b24bbf85d4d1ab4a3fdfc47ee242833c493b7543cba2b005b79eb00993009ac6c1744ab4513e2e46c77dc5ee03fa38da

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

2896

pid	process
2896

Suspicious use of SetThreadContext 1 IoCs

Processes:

9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe

description	pid	process	target process
PID 1304 set thread context of 1628	1304	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe

pid	process
1628	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe
1628	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896
2896

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2896
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe

pid process

1628 9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe

pid	process
2896

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe

description	pid	process	target process
PID 1304 wrote to memory of 1628	1304	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe
PID 1304 wrote to memory of 1628	1304	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe
PID 1304 wrote to memory of 1628	1304	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe
PID 1304 wrote to memory of 1628	1304	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe
PID 1304 wrote to memory of 1628	1304	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe
PID 1304 wrote to memory of 1628	1304	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe	9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe

C:\Users\Admin\AppData\Local\Temp\9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe
"C:\Users\Admin\AppData\Local\Temp\9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Local\Temp\9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe
"C:\Users\Admin\AppData\Local\Temp\9652f805ad7fd4acc2fe0284e17815aee5f45c5e31fae87a4112143a2acd925f.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-116-0x0000000000570000-0x0000000000579000-memory.dmp

Filesize
36KB

Download
memory/1628-117-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1628-118-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2896-119-0x0000000000A40000-0x0000000000A56000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads