smokeloader | bd8915298463741e8f65e70a296aa570d54ddd7acb1ad591f0640ebeac0b1c74

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2022 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

197KB
MD5

7f161373294f2e6a8ae37a071b03b162
SHA1

08fcccd5cca4bd66d3cb015fd090ba1f1e0747fd
SHA256

bd8915298463741e8f65e70a296aa570d54ddd7acb1ad591f0640ebeac0b1c74
SHA512

8bbe8c6fa674139625123f94efac71678447944ca04a803a6d3f5b002b9e9cc9823848cfe37c463182a1df9ea4b073b23322db822e9825a58dc0e09559d852a8
SSDEEP

3072:AbMbfLmfpr5oN5MYxkCKyV1+kFrqrOAhXQ9pkB1enChG/PkkXx:1Lm15sxkCltKhAnaen

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4884-133-0x0000000000820000-0x0000000000829000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 1 IoCs

Processes:

hcescbi

pid process

4924 hcescbi

pid	process
4924	hcescbi

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

file.exehcescbi

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hcescbi
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hcescbi
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hcescbi

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exe

pid	process
4884	file.exe
4884	file.exe
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2056
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

file.exehcescbi

pid process

4884 file.exe
4924 hcescbi

pid	process
2056

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4884

C:\Users\Admin\AppData\Roaming\hcescbi
C:\Users\Admin\AppData\Roaming\hcescbi
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\hcescbi
Filesize
197KB

MD5
7f161373294f2e6a8ae37a071b03b162

SHA1
08fcccd5cca4bd66d3cb015fd090ba1f1e0747fd

SHA256
bd8915298463741e8f65e70a296aa570d54ddd7acb1ad591f0640ebeac0b1c74

SHA512
8bbe8c6fa674139625123f94efac71678447944ca04a803a6d3f5b002b9e9cc9823848cfe37c463182a1df9ea4b073b23322db822e9825a58dc0e09559d852a8

Download Submit
C:\Users\Admin\AppData\Roaming\hcescbi
Filesize
197KB

MD5
7f161373294f2e6a8ae37a071b03b162

SHA1
08fcccd5cca4bd66d3cb015fd090ba1f1e0747fd

SHA256
bd8915298463741e8f65e70a296aa570d54ddd7acb1ad591f0640ebeac0b1c74

SHA512
8bbe8c6fa674139625123f94efac71678447944ca04a803a6d3f5b002b9e9cc9823848cfe37c463182a1df9ea4b073b23322db822e9825a58dc0e09559d852a8

Download Submit
memory/2056-170-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-206-0x0000000002380000-0x0000000002390000-memory.dmp

Filesize
64KB

Download
memory/2056-139-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-140-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-141-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-142-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-143-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-144-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-145-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-146-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-147-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-148-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-149-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-150-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-151-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-153-0x0000000007BF0000-0x0000000007C00000-memory.dmp

Filesize
64KB

Download
memory/2056-152-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-154-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2056-155-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2056-156-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2056-157-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2056-158-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2056-137-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-159-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2056-209-0x0000000002390000-0x00000000023A0000-memory.dmp

Filesize
64KB

Download
memory/2056-208-0x0000000002390000-0x00000000023A0000-memory.dmp

Filesize
64KB

Download
memory/2056-207-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/2056-171-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-205-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-204-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-203-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-165-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-166-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-167-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-168-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-169-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-182-0x0000000002330000-0x0000000002340000-memory.dmp

Filesize
64KB

Download
memory/2056-138-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-198-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-173-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-174-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-175-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-176-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-177-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-178-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-179-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-180-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-181-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-136-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-183-0x0000000002390000-0x00000000023A0000-memory.dmp

Filesize
64KB

Download
memory/2056-184-0x0000000002390000-0x00000000023A0000-memory.dmp

Filesize
64KB

Download
memory/2056-185-0x0000000002330000-0x0000000002340000-memory.dmp

Filesize
64KB

Download
memory/2056-186-0x0000000002390000-0x00000000023A0000-memory.dmp

Filesize
64KB

Download
memory/2056-187-0x0000000002390000-0x00000000023A0000-memory.dmp

Filesize
64KB

Download
memory/2056-188-0x0000000002390000-0x00000000023A0000-memory.dmp

Filesize
64KB

Download
memory/2056-189-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-190-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-191-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-192-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-193-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-194-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-195-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-196-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-197-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-172-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-199-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-200-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-201-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/2056-202-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/4884-135-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download
memory/4884-134-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download
memory/4884-133-0x0000000000820000-0x0000000000829000-memory.dmp

Filesize
36KB

Download
memory/4884-132-0x0000000000869000-0x0000000000879000-memory.dmp

Filesize
64KB

Download
memory/4924-164-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download
memory/4924-163-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download
memory/4924-162-0x00000000007B8000-0x00000000007C8000-memory.dmp

Filesize
64KB

Download