smokeloader | 174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511

General

Target

174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe
Size

364KB
MD5

a04064572099c06bc10428d46d423f7e
SHA1

ed13b58b821d1eb62df8f4226736f751049af3e8
SHA256

174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511
SHA512

56cb60559c60fa1909f609cfdca82da5dd7947a303c33b9021cf4ecb1e37d149aae8f6c65d57c9fe3205c6bb8c62a22ddbb503d6fcc6f00d7312ffd3d8f868a3

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2019

C2

http://emona66.com.kz/nonso/

http://emona667.com.kz/nonso2/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Loads dropped DLL 1 IoCs

Processes:

174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

pid process

2008 174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

description	pid	process	target process
PID 560 set thread context of 2008	560	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

pid	process
2008	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe
2008	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

pid process

560 174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

pid	process
560	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

description	pid	process	target process
PID 560 wrote to memory of 2008	560	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe
PID 560 wrote to memory of 2008	560	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe
PID 560 wrote to memory of 2008	560	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe
PID 560 wrote to memory of 2008	560	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe
PID 560 wrote to memory of 2008	560	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe	174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe

C:\Users\Admin\AppData\Local\Temp\174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe
"C:\Users\Admin\AppData\Local\Temp\174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560

C:\Users\Admin\AppData\Local\Temp\174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe
"C:\Users\Admin\AppData\Local\Temp\174876b3e81985f6ede4bb16076dcb0b92c7067f560145a070481ed2a7de2511.exe"
2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2008

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\65B3.tmp
Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
memory/560-54-0x0000000075271000-0x0000000075273000-memory.dmp

Filesize
8KB

Download
memory/560-55-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1428-59-0x0000000002220000-0x0000000002236000-memory.dmp

Filesize
88KB

Download
memory/2008-56-0x0000000000402D74-mapping.dmp

Download
memory/2008-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads