smokeloader | e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59

Analysis

max time kernel
153s
max time network
147s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
23-11-2022 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59.exe
Size

186KB
MD5

adef01798f8d88da83ad4da94fb4a162
SHA1

520a9ebdfd717acb86aedbeb7cfe21110c2546f2
SHA256

e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59
SHA512

719eaae6a78f36628fe3cdc8c58aa7eaad31b47b8968c9b9c26a4d4cabab55febb43302f0188e8d22bc11bb37dfe47b9bb7de9b0e209bc0360216609625ff3f0
SSDEEP

3072:6ql4GPOZA/CLOKO4vWW/O5MjYwtvw8kKLOs+66icG0JP:9l2LOKO4vht3o66icG0

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2452-146-0x0000000002360000-0x0000000002369000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

2968

pid	process
2968

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59.exe

pid	process
2452	e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59.exe
2452	e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59.exe
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2968
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59.exe

pid process

2452 e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59.exe

pid	process
2968

C:\Users\Admin\AppData\Local\Temp\e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59.exe
"C:\Users\Admin\AppData\Local\Temp\e6b178961df02ac33ec07bfbdd212c9f7222367274e6062d2dbae0dd6fe6fc59.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2452-120-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-121-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-122-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-123-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-124-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-125-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-126-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-127-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-128-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-129-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-130-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-131-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-132-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-133-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-134-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-135-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-137-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-136-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-138-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-139-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-140-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-141-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-143-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-144-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-145-0x0000000000650000-0x00000000006FE000-memory.dmp

Filesize
696KB

Download
memory/2452-146-0x0000000002360000-0x0000000002369000-memory.dmp

Filesize
36KB

Download
memory/2452-147-0x0000000000400000-0x000000000064C000-memory.dmp

Filesize
2.3MB

Download
memory/2452-148-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-149-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-150-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-151-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-152-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-153-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-154-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-155-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-156-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Filesize
1.6MB

Download
memory/2452-157-0x0000000000400000-0x000000000064C000-memory.dmp

Filesize
2.3MB

Download
memory/2452-158-0x0000000000400000-0x000000000064C000-memory.dmp

Filesize
2.3MB

Download