smokeloader | 9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49

General

Target

9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
Size

196KB
MD5

fda1158b9abbcba6ca8fec74fecd0d97
SHA1

14dd8c135abbb4a3b903088e883902506b1c585e
SHA256

9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49
SHA512

f384a69627951c3630c9db003144da266ab5332f34baf99b9dcee629b6a997a44212b1c844482614c80706743b53e212a869cec7a189fc9a9f55021fe3c51990
SSDEEP

3072:XTto6v2LsgcIVN5FTU/heOkXJr05mLbBYrWaVr/PkkXx:t2LGIHTU/heTUWa

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/868-133-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/4328-135-0x0000000000710000-0x0000000000719000-memory.dmp	family_smokeloader
behavioral1/memory/868-136-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/868-137-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/480-144-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/480-145-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 2 IoCs

Processes:

tuttbsvtuttbsv

pid process

1340 tuttbsv
480 tuttbsv

pid	process
1340	tuttbsv
480	tuttbsv

Suspicious use of SetThreadContext 2 IoCs

Processes:

9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exetuttbsv

description	pid	process	target process
PID 4328 set thread context of 868	4328	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
PID 1340 set thread context of 480	1340	tuttbsv	tuttbsv

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exetuttbsv

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tuttbsv
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tuttbsv
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tuttbsv
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe

pid	process
868	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
868	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3052
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exetuttbsv

pid process

868 9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
480 tuttbsv
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 3052
Token: SeCreatePagefilePrivilege 3052

pid	process
3052

description	pid	process
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exetuttbsv

description	pid	process	target process
PID 4328 wrote to memory of 868	4328	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
PID 4328 wrote to memory of 868	4328	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
PID 4328 wrote to memory of 868	4328	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
PID 4328 wrote to memory of 868	4328	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
PID 4328 wrote to memory of 868	4328	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
PID 4328 wrote to memory of 868	4328	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe	9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
PID 1340 wrote to memory of 480	1340	tuttbsv	tuttbsv
PID 1340 wrote to memory of 480	1340	tuttbsv	tuttbsv
PID 1340 wrote to memory of 480	1340	tuttbsv	tuttbsv
PID 1340 wrote to memory of 480	1340	tuttbsv	tuttbsv
PID 1340 wrote to memory of 480	1340	tuttbsv	tuttbsv
PID 1340 wrote to memory of 480	1340	tuttbsv	tuttbsv

C:\Users\Admin\AppData\Local\Temp\9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
"C:\Users\Admin\AppData\Local\Temp\9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4328

C:\Users\Admin\AppData\Local\Temp\9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe
"C:\Users\Admin\AppData\Local\Temp\9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:868

C:\Users\Admin\AppData\Roaming\tuttbsv
C:\Users\Admin\AppData\Roaming\tuttbsv
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1340

C:\Users\Admin\AppData\Roaming\tuttbsv
C:\Users\Admin\AppData\Roaming\tuttbsv
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\tuttbsv
Filesize
196KB

MD5
fda1158b9abbcba6ca8fec74fecd0d97

SHA1
14dd8c135abbb4a3b903088e883902506b1c585e

SHA256
9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49

SHA512
f384a69627951c3630c9db003144da266ab5332f34baf99b9dcee629b6a997a44212b1c844482614c80706743b53e212a869cec7a189fc9a9f55021fe3c51990

Download Submit
C:\Users\Admin\AppData\Roaming\tuttbsv
Filesize
196KB

MD5
fda1158b9abbcba6ca8fec74fecd0d97

SHA1
14dd8c135abbb4a3b903088e883902506b1c585e

SHA256
9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49

SHA512
f384a69627951c3630c9db003144da266ab5332f34baf99b9dcee629b6a997a44212b1c844482614c80706743b53e212a869cec7a189fc9a9f55021fe3c51990

Download Submit
C:\Users\Admin\AppData\Roaming\tuttbsv
Filesize
196KB

MD5
fda1158b9abbcba6ca8fec74fecd0d97

SHA1
14dd8c135abbb4a3b903088e883902506b1c585e

SHA256
9e65967f6b4441187eb93f33ec2bf04c307ff184fc645748fcbb406d70166d49

SHA512
f384a69627951c3630c9db003144da266ab5332f34baf99b9dcee629b6a997a44212b1c844482614c80706743b53e212a869cec7a189fc9a9f55021fe3c51990

Download Submit
memory/480-140-0x0000000000000000-mapping.dmp

Download
memory/480-144-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/480-145-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/868-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/868-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/868-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/868-132-0x0000000000000000-mapping.dmp

Download
memory/1340-143-0x0000000000749000-0x0000000000759000-memory.dmp

Filesize
64KB

Download
memory/4328-135-0x0000000000710000-0x0000000000719000-memory.dmp

Filesize
36KB

Download
memory/4328-134-0x0000000000808000-0x0000000000819000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads