smokeloader | 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9

General

Target

41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
Size

240KB
MD5

491bf48093ce883bc2caf2e7d37f91a5
SHA1

388f82016f77a1809e73162c447d1d3d34288b29
SHA256

41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9
SHA512

223cb619a9598ffd1f33197bd25c8208a3792a46b7062945ec320e2f499fe86a40f17720b8140cfc936f2b0b1d58620bb31dba1b0fa25935cb65e404ae90c7c0

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2017

C2

http://derevo.bit/1/

http://ds12.ng/1/

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe

description	pid	process	target process
PID 2000 set thread context of 1976	2000	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1460 1976 WerFault.exe 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe

pid process

1976 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe

pid	pid_target	process	target process
1460	1976	WerFault.exe	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe

pid	process
1976	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe

description	pid	process	target process
PID 2000 wrote to memory of 1976	2000	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
PID 2000 wrote to memory of 1976	2000	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
PID 2000 wrote to memory of 1976	2000	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
PID 2000 wrote to memory of 1976	2000	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
PID 2000 wrote to memory of 1976	2000	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
PID 2000 wrote to memory of 1976	2000	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
PID 2000 wrote to memory of 1976	2000	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
PID 1976 wrote to memory of 1460	1976	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe	WerFault.exe
PID 1976 wrote to memory of 1460	1976	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe	WerFault.exe
PID 1976 wrote to memory of 1460	1976	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe	WerFault.exe
PID 1976 wrote to memory of 1460	1976	41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
"C:\Users\Admin\AppData\Local\Temp\41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
"C:\Users\Admin\AppData\Local\Temp\41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 260
3⤵
- Program crash
PID:1460

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-60-0x0000000000000000-mapping.dmp

Download
memory/1976-54-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1976-55-0x000000000040147C-mapping.dmp

Download
memory/1976-56-0x0000000075221000-0x0000000075223000-memory.dmp

Filesize
8KB

Download
memory/1976-58-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1976-59-0x0000000000030000-0x000000000003A000-memory.dmp

Filesize
40KB

Download
memory/1976-61-0x0000000000030000-0x000000000003A000-memory.dmp

Filesize
40KB

Download
memory/2000-57-0x0000000000491000-0x0000000000496000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing