smokeloader | f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-06-2022 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a.exe
Size

258KB
MD5

ddc657bf8e42b36b844bf54302ee01a5
SHA1

150040b2de42db56d131579df1601b2c8fcee60e
SHA256

f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a
SHA512

ca7a3c49ec286a24f6e79d062b0cdccdb75dbe5e4bfed3a9d3e4fb10e5cb80782078be13ad318e81752dd5c14b828bbbf54c0995a43f88ea030483f36aa37821

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2018

http://ghjk78kjhb.net/

http://cleancleankkl.net/

http://dunujilis11r.net/

http://sulionuili1.in/

http://eseruuynli2.net/

http://nulikuliey.net/

http://oohdojssks9uf.net/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a.exe

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a.exe

pid	process
4428	f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a.exe
4428	f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a.exe

C:\Users\Admin\AppData\Local\Temp\f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a.exe
"C:\Users\Admin\AppData\Local\Temp\f070751139172ca179cbd7a0854662cf27fb4ca216c73a6c53d50a49a37bc23a.exe"
1⤵
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4428

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-133-0x0000000000590000-0x00000000005A5000-memory.dmp

Filesize
84KB

Download
memory/4428-130-0x000000000054D000-0x0000000000557000-memory.dmp

Filesize
40KB

Download
memory/4428-131-0x00000000020A0000-0x00000000020AA000-memory.dmp

Filesize
40KB

Download
memory/4428-132-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download