smokeloader | 278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36

General

Target

278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
Size

197KB
MD5

6e27619d1a45314e0d15b629d17ab887
SHA1

b3c682d16a3fb46511d6a77de5468fa58c483eeb
SHA256

278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36
SHA512

a2877e6fffe49f50a6192bbca69e448634bd0dca36470c0a41fd8930b9445863318c1c3d134a1ad004bc048e7a596ba5a3a509601e47899a4e572a25aa084bf5
SSDEEP

3072:oSsFfSLiJblJhN5iwjxB6zwXsMBsYt5rtzUMpBDydLUQ/PkkXx:zLklJnxBUwZD5zDq

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/116-133-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/1336-135-0x00000000006E0000-0x00000000006E9000-memory.dmp	family_smokeloader
behavioral1/memory/116-136-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/116-137-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/60-144-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/60-145-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 2 IoCs

Processes:

uaagscjuaagscj

pid process

3360 uaagscj
60 uaagscj

pid	process
3360	uaagscj
60	uaagscj

Suspicious use of SetThreadContext 2 IoCs

Processes:

278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exeuaagscj

description	pid	process	target process
PID 1336 set thread context of 116	1336	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
PID 3360 set thread context of 60	3360	uaagscj	uaagscj

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exeuaagscj

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uaagscj
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uaagscj
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uaagscj

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe

pid	process
116	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
116	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864
2864

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2864
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exeuaagscj

pid process

116 278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
60 uaagscj
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 2864
Token: SeCreatePagefilePrivilege 2864

pid	process
2864

description	pid	process
Token: SeShutdownPrivilege	2864
Token: SeCreatePagefilePrivilege	2864

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exeuaagscj

description	pid	process	target process
PID 1336 wrote to memory of 116	1336	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
PID 1336 wrote to memory of 116	1336	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
PID 1336 wrote to memory of 116	1336	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
PID 1336 wrote to memory of 116	1336	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
PID 1336 wrote to memory of 116	1336	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
PID 1336 wrote to memory of 116	1336	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe	278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
PID 3360 wrote to memory of 60	3360	uaagscj	uaagscj
PID 3360 wrote to memory of 60	3360	uaagscj	uaagscj
PID 3360 wrote to memory of 60	3360	uaagscj	uaagscj
PID 3360 wrote to memory of 60	3360	uaagscj	uaagscj
PID 3360 wrote to memory of 60	3360	uaagscj	uaagscj
PID 3360 wrote to memory of 60	3360	uaagscj	uaagscj

C:\Users\Admin\AppData\Local\Temp\278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
"C:\Users\Admin\AppData\Local\Temp\278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1336

C:\Users\Admin\AppData\Local\Temp\278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe
"C:\Users\Admin\AppData\Local\Temp\278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:116

C:\Users\Admin\AppData\Roaming\uaagscj
C:\Users\Admin\AppData\Roaming\uaagscj
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3360

C:\Users\Admin\AppData\Roaming\uaagscj
C:\Users\Admin\AppData\Roaming\uaagscj
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:60

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\uaagscj
Filesize
197KB

MD5
6e27619d1a45314e0d15b629d17ab887

SHA1
b3c682d16a3fb46511d6a77de5468fa58c483eeb

SHA256
278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36

SHA512
a2877e6fffe49f50a6192bbca69e448634bd0dca36470c0a41fd8930b9445863318c1c3d134a1ad004bc048e7a596ba5a3a509601e47899a4e572a25aa084bf5

Download Submit
C:\Users\Admin\AppData\Roaming\uaagscj
Filesize
197KB

MD5
6e27619d1a45314e0d15b629d17ab887

SHA1
b3c682d16a3fb46511d6a77de5468fa58c483eeb

SHA256
278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36

SHA512
a2877e6fffe49f50a6192bbca69e448634bd0dca36470c0a41fd8930b9445863318c1c3d134a1ad004bc048e7a596ba5a3a509601e47899a4e572a25aa084bf5

Download Submit
C:\Users\Admin\AppData\Roaming\uaagscj
Filesize
197KB

MD5
6e27619d1a45314e0d15b629d17ab887

SHA1
b3c682d16a3fb46511d6a77de5468fa58c483eeb

SHA256
278ad62d112590a414d528a6f18a962fec0a555d66af55e3e8df19a19931fc36

SHA512
a2877e6fffe49f50a6192bbca69e448634bd0dca36470c0a41fd8930b9445863318c1c3d134a1ad004bc048e7a596ba5a3a509601e47899a4e572a25aa084bf5

Download Submit
memory/60-140-0x0000000000000000-mapping.dmp

Download
memory/60-144-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/60-145-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/116-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/116-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/116-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/116-132-0x0000000000000000-mapping.dmp

Download
memory/1336-135-0x00000000006E0000-0x00000000006E9000-memory.dmp

Filesize
36KB

Download
memory/1336-134-0x0000000000738000-0x0000000000749000-memory.dmp

Filesize
68KB

Download
memory/3360-143-0x0000000000828000-0x0000000000838000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads