smokeloader | c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b

General

Target

c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
Size

145KB
MD5

c9baf3fdcc4fe10d9be46cf41ec65ce6
SHA1

d1b54cacf1c6005563032698fef54ab9fae35606
SHA256

c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b
SHA512

3f37b0e21f2cf3a3c6f25e725a6e12eaf1f7d8c78cee98415e5a01ef83502c9f86a504990024e21b1307f448838389e96a620e4c02b69257339aac58c85ec495
SSDEEP

1536:nuqVi0rla1ikEhfRYjg1D29SyqreamdNOS8A3sTMk7y9oZAJady1ZWFQZhoDw/Oi:nuqVxjhfouDzprAIS8AcdO9spOWEhXO

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4348-133-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/3036-135-0x0000000000710000-0x0000000000719000-memory.dmp	family_smokeloader
behavioral1/memory/4348-136-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/4348-137-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5D67514B-8825-40DF-9C72-54AC350C88AF}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{35374320-6C0C-4D8D-8D70-572AB159D3F5}.catalogItem	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe

description	pid	process	target process
PID 3036 set thread context of 4348	3036	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe

pid	process
4348	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
4348	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004
3004

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3004
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe

pid process

4348 c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

pid process

3004
3004
3004
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

pid process

3004
3004
3004

pid	process
3004

pid	process
3004
3004
3004

pid	process
3004
3004
3004

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe

description	pid	process	target process
PID 3036 wrote to memory of 4348	3036	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
PID 3036 wrote to memory of 4348	3036	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
PID 3036 wrote to memory of 4348	3036	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
PID 3036 wrote to memory of 4348	3036	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
PID 3036 wrote to memory of 4348	3036	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
PID 3036 wrote to memory of 4348	3036	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe	c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe

C:\Users\Admin\AppData\Local\Temp\c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
"C:\Users\Admin\AppData\Local\Temp\c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3036

C:\Users\Admin\AppData\Local\Temp\c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe
"C:\Users\Admin\AppData\Local\Temp\c59d96ba9fa006d1cb90b9cc650f9b56cdf88cd56dcf5f0375cd54afaaa5bd0b.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3360

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3036-134-0x000000000079E000-0x00000000007AE000-memory.dmp

Filesize
64KB

Download
memory/3036-135-0x0000000000710000-0x0000000000719000-memory.dmp

Filesize
36KB

Download
memory/4348-132-0x0000000000000000-mapping.dmp

Download
memory/4348-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4348-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4348-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads