smokeloader | a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40

Analysis

max time kernel
151s
max time network
148s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
02/10/2022, 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe
Size

133KB
MD5

5d5a692e65115e4bff23f626804855a1
SHA1

3b1020ef24e7c572e0881540ceb896c111a906af
SHA256

a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40
SHA512

65ca546cabff3c192d4ec7be2e40e1624b87d83ab9f83064abe76d3127518e2602e21d871f792cc44bb4b70e919fe896d8e177df66b47ec5f799d3856c4f066d
SSDEEP

1536:YzjbBPRx/h5Vw+GIiSRdCJB6wyXVSo4ziJYNQXdAoHtZfUz8CfnIZVN6U3afmlMF:YzRvkSR4xGAVzeYQdxtZfWJn0dKf/31

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 8 IoCs

resource	yara_rule
behavioral1/memory/4864-146-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/4864-147-0x0000000000402DD8-mapping.dmp	family_smokeloader
behavioral1/memory/3812-150-0x0000000000660000-0x0000000000669000-memory.dmp	family_smokeloader
behavioral1/memory/4864-164-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/4864-179-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/2536-211-0x0000000000402DD8-mapping.dmp	family_smokeloader
behavioral1/memory/2536-243-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/2536-244-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 2 IoCs

pid	Process
4632	gdttbct
2536	gdttbct

Deletes itself 1 IoCs

pid	Process
3040	Process not Found

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3812 set thread context of 4864	3812	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe	66
PID 4632 set thread context of 2536	4632	gdttbct	68

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	gdttbct
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	gdttbct
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	gdttbct

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4864	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe
4864	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4864	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe
2536	gdttbct

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 4864	3812	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe	66
PID 3812 wrote to memory of 4864	3812	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe	66
PID 3812 wrote to memory of 4864	3812	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe	66
PID 3812 wrote to memory of 4864	3812	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe	66
PID 3812 wrote to memory of 4864	3812	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe	66
PID 3812 wrote to memory of 4864	3812	a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe	66
PID 4632 wrote to memory of 2536	4632	gdttbct	68
PID 4632 wrote to memory of 2536	4632	gdttbct	68
PID 4632 wrote to memory of 2536	4632	gdttbct	68
PID 4632 wrote to memory of 2536	4632	gdttbct	68
PID 4632 wrote to memory of 2536	4632	gdttbct	68
PID 4632 wrote to memory of 2536	4632	gdttbct	68

C:\Users\Admin\AppData\Local\Temp\a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe
"C:\Users\Admin\AppData\Local\Temp\a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Users\Admin\AppData\Local\Temp\a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe
  "C:\Users\Admin\AppData\Local\Temp\a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4864

C:\Users\Admin\AppData\Roaming\gdttbct
C:\Users\Admin\AppData\Roaming\gdttbct
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Roaming\gdttbct
  C:\Users\Admin\AppData\Roaming\gdttbct
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:2536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\gdttbct

Filesize
133KB

MD5
5d5a692e65115e4bff23f626804855a1

SHA1
3b1020ef24e7c572e0881540ceb896c111a906af

SHA256
a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40

SHA512
65ca546cabff3c192d4ec7be2e40e1624b87d83ab9f83064abe76d3127518e2602e21d871f792cc44bb4b70e919fe896d8e177df66b47ec5f799d3856c4f066d

Download Submit
C:\Users\Admin\AppData\Roaming\gdttbct

Filesize
133KB

MD5
5d5a692e65115e4bff23f626804855a1

SHA1
3b1020ef24e7c572e0881540ceb896c111a906af

SHA256
a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40

SHA512
65ca546cabff3c192d4ec7be2e40e1624b87d83ab9f83064abe76d3127518e2602e21d871f792cc44bb4b70e919fe896d8e177df66b47ec5f799d3856c4f066d

Download Submit
C:\Users\Admin\AppData\Roaming\gdttbct

Filesize
133KB

MD5
5d5a692e65115e4bff23f626804855a1

SHA1
3b1020ef24e7c572e0881540ceb896c111a906af

SHA256
a90ea24bb49d6c60753959c7708de2a364567b2d4d862bc6a8284be44c672d40

SHA512
65ca546cabff3c192d4ec7be2e40e1624b87d83ab9f83064abe76d3127518e2602e21d871f792cc44bb4b70e919fe896d8e177df66b47ec5f799d3856c4f066d

Download Submit
memory/2536-244-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2536-243-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3812-135-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-141-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-123-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-124-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-125-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-126-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-127-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-128-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-129-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-130-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-131-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-133-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-132-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-134-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-116-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-136-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-138-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-139-0x0000000000690000-0x00000000007DA000-memory.dmp

Filesize
1.3MB

Download
memory/3812-140-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-122-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-142-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-143-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-144-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-145-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-150-0x0000000000660000-0x0000000000669000-memory.dmp

Filesize
36KB

Download
memory/3812-117-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-118-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-119-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-121-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3812-120-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4632-220-0x0000000000859000-0x000000000086A000-memory.dmp

Filesize
68KB

Download
memory/4632-183-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4632-182-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4632-181-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4632-184-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4632-186-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4632-185-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-152-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-158-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-157-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-159-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-160-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-161-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-162-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-163-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-164-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4864-165-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-166-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-167-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-168-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-169-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-170-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-171-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-172-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-173-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-174-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-175-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-156-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-155-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-154-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-153-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-149-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-151-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-148-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-146-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4864-176-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-177-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-178-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4864-179-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download