smokeloader | eb6e244c66a5598aab05cdc653a5781faa499773294f2016bb5c13f9bfc7c782

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/09/2022, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb6e244c66a5598aab05cdc653a5781faa499773294f2016bb5c13f9bfc7c782.exe
Size

290KB
MD5

e81b64e167a82274326035abfcca58dd
SHA1

074f8417cdba35a0d3d51ca1fddc69939b4dcc2c
SHA256

eb6e244c66a5598aab05cdc653a5781faa499773294f2016bb5c13f9bfc7c782
SHA512

f0a6b4a4b90aa59c5ba1ec592ed44e04859de5c56bccc62dec689fec4284ca4500cb207e447fbf7d161ae4d0ad4d2e6d0759b7cc7c0a7331fc4e28fccfe6f94c
SSDEEP

6144:LqOLtzdutR5v6AfkJyCdZwEkk0hXnigabwVfs:LqOJzdEoJyCd2Fti

Score

10^/10

smokeloader backdoor spyware stealer trojan upx

Malware Config

Signatures

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral1/memory/2796-133-0x00000000005E0000-0x00000000005E9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
2540	EB20.exe
4732	13F6.exe
2428	1E77.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000300000001e499-145.dat	upx
behavioral1/files/0x000300000001e499-146.dat	upx
behavioral1/memory/2428-147-0x0000000000BF0000-0x0000000001E7C000-memory.dmp	upx
behavioral1/memory/2428-175-0x0000000000BF0000-0x0000000001E7C000-memory.dmp	upx
behavioral1/memory/2428-185-0x0000000000BF0000-0x0000000001E7C000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eb6e244c66a5598aab05cdc653a5781faa499773294f2016bb5c13f9bfc7c782.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eb6e244c66a5598aab05cdc653a5781faa499773294f2016bb5c13f9bfc7c782.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eb6e244c66a5598aab05cdc653a5781faa499773294f2016bb5c13f9bfc7c782.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2796	eb6e244c66a5598aab05cdc653a5781faa499773294f2016bb5c13f9bfc7c782.exe
2796	eb6e244c66a5598aab05cdc653a5781faa499773294f2016bb5c13f9bfc7c782.exe
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
2796	eb6e244c66a5598aab05cdc653a5781faa499773294f2016bb5c13f9bfc7c782.exe
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found
2416	Process not Found

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeShutdownPrivilege	2416	Process not Found
Token: SeCreatePagefilePrivilege	2416	Process not Found

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2540	2416	Process not Found	89
PID 2416 wrote to memory of 2540	2416	Process not Found	89
PID 2416 wrote to memory of 2540	2416	Process not Found	89
PID 2540 wrote to memory of 1504	2540	EB20.exe	91
PID 2540 wrote to memory of 1504	2540	EB20.exe	91
PID 2540 wrote to memory of 1504	2540	EB20.exe	91
PID 2416 wrote to memory of 4732	2416	Process not Found	92
PID 2416 wrote to memory of 4732	2416	Process not Found	92
PID 2416 wrote to memory of 4732	2416	Process not Found	92
PID 4732 wrote to memory of 3052	4732	13F6.exe	94
PID 4732 wrote to memory of 3052	4732	13F6.exe	94
PID 4732 wrote to memory of 3052	4732	13F6.exe	94
PID 2416 wrote to memory of 2428	2416	Process not Found	95
PID 2416 wrote to memory of 2428	2416	Process not Found	95
PID 2416 wrote to memory of 4008	2416	Process not Found	96
PID 2416 wrote to memory of 4008	2416	Process not Found	96
PID 2416 wrote to memory of 4008	2416	Process not Found	96
PID 2416 wrote to memory of 4008	2416	Process not Found	96
PID 2416 wrote to memory of 2252	2416	Process not Found	97
PID 2416 wrote to memory of 2252	2416	Process not Found	97
PID 2416 wrote to memory of 2252	2416	Process not Found	97
PID 2416 wrote to memory of 4836	2416	Process not Found	98
PID 2416 wrote to memory of 4836	2416	Process not Found	98
PID 2416 wrote to memory of 4836	2416	Process not Found	98
PID 2416 wrote to memory of 4836	2416	Process not Found	98
PID 2416 wrote to memory of 4000	2416	Process not Found	99
PID 2416 wrote to memory of 4000	2416	Process not Found	99
PID 2416 wrote to memory of 4000	2416	Process not Found	99
PID 2416 wrote to memory of 1412	2416	Process not Found	100
PID 2416 wrote to memory of 1412	2416	Process not Found	100
PID 2416 wrote to memory of 1412	2416	Process not Found	100
PID 2416 wrote to memory of 1412	2416	Process not Found	100
PID 2416 wrote to memory of 4444	2416	Process not Found	101
PID 2416 wrote to memory of 4444	2416	Process not Found	101
PID 2416 wrote to memory of 4444	2416	Process not Found	101
PID 2416 wrote to memory of 4444	2416	Process not Found	101
PID 2416 wrote to memory of 1564	2416	Process not Found	102
PID 2416 wrote to memory of 1564	2416	Process not Found	102
PID 2416 wrote to memory of 1564	2416	Process not Found	102
PID 2416 wrote to memory of 1564	2416	Process not Found	102
PID 2416 wrote to memory of 3256	2416	Process not Found	103
PID 2416 wrote to memory of 3256	2416	Process not Found	103
PID 2416 wrote to memory of 3256	2416	Process not Found	103
PID 2416 wrote to memory of 2320	2416	Process not Found	104
PID 2416 wrote to memory of 2320	2416	Process not Found	104
PID 2416 wrote to memory of 2320	2416	Process not Found	104
PID 2416 wrote to memory of 2320	2416	Process not Found	104
PID 2428 wrote to memory of 1924	2428	1E77.exe	105
PID 2428 wrote to memory of 1924	2428	1E77.exe	105

C:\Users\Admin\AppData\Local\Temp\eb6e244c66a5598aab05cdc653a5781faa499773294f2016bb5c13f9bfc7c782.exe
"C:\Users\Admin\AppData\Local\Temp\eb6e244c66a5598aab05cdc653a5781faa499773294f2016bb5c13f9bfc7c782.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2796

C:\Users\Admin\AppData\Local\Temp\EB20.exe
C:\Users\Admin\AppData\Local\Temp\EB20.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1504

C:\Users\Admin\AppData\Local\Temp\13F6.exe
C:\Users\Admin\AppData\Local\Temp\13F6.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:3052

C:\Users\Admin\AppData\Local\Temp\1E77.exe
C:\Users\Admin\AppData\Local\Temp\1E77.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "" "Get-WmiObject Win32_PortConnector"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1924

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4008

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2252

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4836

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4000

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1412

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4444

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1564

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3256

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\13F6.exe

Filesize
509KB

MD5
63dda87c7869028ef80b5038c9627191

SHA1
86f15cdac475317fc3a796792b78f74ccb61e1e9

SHA256
855c9907076eff340498370dcab67b5a229da93168a99ae33672e0031f15b329

SHA512
bfcc8b314eba95e85d89a0dbf0f77e9b4bbea079b511003ec2d0515e2f2c2b4f85112b5a5d3c30c79d8bcc408c6fb1e05fa99a3d5280b9f1259eaf8179511b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\13F6.exe

Filesize
509KB

MD5
63dda87c7869028ef80b5038c9627191

SHA1
86f15cdac475317fc3a796792b78f74ccb61e1e9

SHA256
855c9907076eff340498370dcab67b5a229da93168a99ae33672e0031f15b329

SHA512
bfcc8b314eba95e85d89a0dbf0f77e9b4bbea079b511003ec2d0515e2f2c2b4f85112b5a5d3c30c79d8bcc408c6fb1e05fa99a3d5280b9f1259eaf8179511b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\1E77.exe

Filesize
5.1MB

MD5
88a97d011f511b0f820d784520797f5d

SHA1
f627b180eb1beae6f9f8320d2fd015523967ca7a

SHA256
c243ce72605b11f0136f74d54ece5cad4c9d5a099a52798fca637a5fe0e31549

SHA512
3069bed92afd9cd30d63b7d7427f4f0a35a371bba3a22068a102ff6f1d42c35f0b5343eeba64f2d2136fb2d1d6e5323ec299b876e52f033b983ad853fe36849f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1E77.exe

Filesize
5.1MB

MD5
88a97d011f511b0f820d784520797f5d

SHA1
f627b180eb1beae6f9f8320d2fd015523967ca7a

SHA256
c243ce72605b11f0136f74d54ece5cad4c9d5a099a52798fca637a5fe0e31549

SHA512
3069bed92afd9cd30d63b7d7427f4f0a35a371bba3a22068a102ff6f1d42c35f0b5343eeba64f2d2136fb2d1d6e5323ec299b876e52f033b983ad853fe36849f

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB20.exe

Filesize
358KB

MD5
184a9b3b2ce488d7a11741898fcb236c

SHA1
12c9c6d786bc342dd1e7361ace1aed079c0fb393

SHA256
a7b8f421b8cdb00be57e58a963443c872272387a1f7c405809f5bb32597c6345

SHA512
24797456784434ea984d2b604a2e97e6eb9ed087f1ffee86a992ae93c35dae7868edee00130abf0c60ff20c153e1b32bf292ed0ef7360f0572ce85f2fad608ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB20.exe

Filesize
358KB

MD5
184a9b3b2ce488d7a11741898fcb236c

SHA1
12c9c6d786bc342dd1e7361ace1aed079c0fb393

SHA256
a7b8f421b8cdb00be57e58a963443c872272387a1f7c405809f5bb32597c6345

SHA512
24797456784434ea984d2b604a2e97e6eb9ed087f1ffee86a992ae93c35dae7868edee00130abf0c60ff20c153e1b32bf292ed0ef7360f0572ce85f2fad608ed

Download Submit
memory/1412-161-0x00000000013D0000-0x00000000013F2000-memory.dmp

Filesize
136KB

Download
memory/1412-162-0x00000000013A0000-0x00000000013C7000-memory.dmp

Filesize
156KB

Download
memory/1412-179-0x00000000013D0000-0x00000000013F2000-memory.dmp

Filesize
136KB

Download
memory/1564-168-0x0000000000B20000-0x0000000000B2B000-memory.dmp

Filesize
44KB

Download
memory/1564-186-0x0000000000B30000-0x0000000000B36000-memory.dmp

Filesize
24KB

Download
memory/1564-167-0x0000000000B30000-0x0000000000B36000-memory.dmp

Filesize
24KB

Download
memory/1924-181-0x000001587F090000-0x000001587F0B2000-memory.dmp

Filesize
136KB

Download
memory/1924-183-0x00007FFAA2510000-0x00007FFAA2FD1000-memory.dmp

Filesize
10.8MB

Download
memory/1924-184-0x00007FFAA2510000-0x00007FFAA2FD1000-memory.dmp

Filesize
10.8MB

Download
memory/2252-177-0x0000000000580000-0x0000000000589000-memory.dmp

Filesize
36KB

Download
memory/2252-152-0x0000000000580000-0x0000000000589000-memory.dmp

Filesize
36KB

Download
memory/2252-153-0x0000000000570000-0x000000000057F000-memory.dmp

Filesize
60KB

Download
memory/2320-173-0x0000000000E00000-0x0000000000E08000-memory.dmp

Filesize
32KB

Download
memory/2320-188-0x0000000000E00000-0x0000000000E08000-memory.dmp

Filesize
32KB

Download
memory/2320-174-0x0000000000BF0000-0x0000000000BFB000-memory.dmp

Filesize
44KB

Download
memory/2428-147-0x0000000000BF0000-0x0000000001E7C000-memory.dmp

Filesize
18.5MB

Download
memory/2428-185-0x0000000000BF0000-0x0000000001E7C000-memory.dmp

Filesize
18.5MB

Download
memory/2428-175-0x0000000000BF0000-0x0000000001E7C000-memory.dmp

Filesize
18.5MB

Download
memory/2796-134-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2796-135-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2796-132-0x000000000063D000-0x000000000064E000-memory.dmp

Filesize
68KB

Download
memory/2796-133-0x00000000005E0000-0x00000000005E9000-memory.dmp

Filesize
36KB

Download
memory/3256-170-0x0000000000680000-0x0000000000687000-memory.dmp

Filesize
28KB

Download
memory/3256-171-0x00000000003F0000-0x00000000003FD000-memory.dmp

Filesize
52KB

Download
memory/3256-187-0x0000000000680000-0x0000000000687000-memory.dmp

Filesize
28KB

Download
memory/4000-159-0x0000000001020000-0x000000000102C000-memory.dmp

Filesize
48KB

Download
memory/4000-158-0x0000000001030000-0x0000000001036000-memory.dmp

Filesize
24KB

Download
memory/4008-150-0x00000000005B0000-0x00000000005BB000-memory.dmp

Filesize
44KB

Download
memory/4008-176-0x00000000005C0000-0x00000000005C7000-memory.dmp

Filesize
28KB

Download
memory/4008-149-0x00000000005C0000-0x00000000005C7000-memory.dmp

Filesize
28KB

Download
memory/4444-165-0x0000000000790000-0x0000000000799000-memory.dmp

Filesize
36KB

Download
memory/4444-182-0x00000000007A0000-0x00000000007A5000-memory.dmp

Filesize
20KB

Download
memory/4444-164-0x00000000007A0000-0x00000000007A5000-memory.dmp

Filesize
20KB

Download
memory/4836-155-0x0000000000DF0000-0x0000000000DF5000-memory.dmp

Filesize
20KB

Download
memory/4836-156-0x0000000000DE0000-0x0000000000DE9000-memory.dmp

Filesize
36KB

Download
memory/4836-178-0x0000000000DF0000-0x0000000000DF5000-memory.dmp

Filesize
20KB

Download