smokeloader | 33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
19-06-2022 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd.exe
Size

275KB
MD5

5bc468b6663bd98e06c8084cc9794065
SHA1

b216217104adaaa021d5a89478ecf8176633ab8d
SHA256

33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd
SHA512

aa47e7e19ec2bc158ed81932f35c2882ef1224a531bfb536e290c1e5274f6025b1ed68b54c6fd599adfba8fdd132f2dd9ef53c280c731a84497a33bef3724dcd

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2018

http://taj.co.ug/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd.exe

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd.exe

pid	process
776	33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd.exe
776	33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd.exe

C:\Users\Admin\AppData\Local\Temp\33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd.exe
"C:\Users\Admin\AppData\Local\Temp\33f6870266904dcf2e1084a5da3536a01041e3e636d3306163ab270024490acd.exe"
1⤵
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-130-0x00000000006F5000-0x00000000006FE000-memory.dmp

Filesize
36KB

Download
memory/776-131-0x00000000006F5000-0x00000000006FE000-memory.dmp

Filesize
36KB

Download
memory/776-132-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1504-133-0x00000000004D0000-0x00000000004E5000-memory.dmp

Filesize
84KB

Download