smokeloader | 282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13

Analysis

max time kernel
168s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
16-06-2022 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe
Size

627KB
MD5

7add86a68897d50e8d47e54f5680f0b0
SHA1

43aec342acd49bd8ba676bcd1a66b696c440eade
SHA256

282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13
SHA512

8e0fab13e6070db1dc9d21ae78a47eb6c2217435640cfd65de9774378d23176ae190e032f6ae5885a574bda994dfccad20b5920a0359c4ba2611ec1337ea3136

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2018

http://otsosukadzima23334.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe

pid	process
480	282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe
480	282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe

pid	process
480	282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe
480	282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe

C:\Users\Admin\AppData\Local\Temp\282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe
"C:\Users\Admin\AppData\Local\Temp\282eaff1168bd0b0172be664d51a45179a3687992f7b4e6e8f574801f5177f13.exe"
1⤵
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/480-130-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/480-131-0x0000000002280000-0x00000000022BA000-memory.dmp

Filesize
232KB

Download
memory/480-132-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/480-134-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3136-133-0x0000000001410000-0x0000000001425000-memory.dmp

Filesize
84KB

Download