smokeloader | 42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6

Analysis

max time kernel
150s
max time network
71s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
29-11-2022 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
Size

145KB
MD5

25fb23643c5a4679391d6c9e76135c47
SHA1

30153cccd490635f53a751e99fde187bca7de95d
SHA256

42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6
SHA512

c463f36bb22b066bbc090159f9956cd56b31e1ac09b454df527bb8368d32cf01a7aa1601dc87c8e77bf084a518edb0c87234372e78367d7c2e4f95309d2652da
SSDEEP

3072:xqD2cl/JdYWUky58bADwoZNIg+FhAmfx9V:PcrdxUs6wieg+XTfrV

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4808-151-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/4808-152-0x0000000000402DD8-mapping.dmp	family_smokeloader
behavioral1/memory/4808-166-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/4808-183-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/2392-218-0x0000000000580000-0x0000000000589000-memory.dmp	family_smokeloader
behavioral1/memory/1772-216-0x0000000000402DD8-mapping.dmp	family_smokeloader
behavioral1/memory/1772-248-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/1772-249-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 2 IoCs

Processes:

svassubsvassub

pid process

2392 svassub
1772 svassub
Deletes itself 1 IoCs

Processes:

pid process

2836

pid	process
2392	svassub
1772	svassub

pid	process
2836

Suspicious use of SetThreadContext 2 IoCs

Processes:

42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exesvassub

description	pid	process	target process
PID 1748 set thread context of 4808	1748	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
PID 2392 set thread context of 1772	2392	svassub	svassub

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exesvassub

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svassub
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svassub
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svassub
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe

pid	process
4808	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
4808	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2836
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exesvassub

pid process

4808 42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
1772 svassub
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 2836
Token: SeCreatePagefilePrivilege 2836

pid	process
2836

description	pid	process
Token: SeShutdownPrivilege	2836
Token: SeCreatePagefilePrivilege	2836

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exesvassub

description	pid	process	target process
PID 1748 wrote to memory of 4808	1748	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
PID 1748 wrote to memory of 4808	1748	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
PID 1748 wrote to memory of 4808	1748	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
PID 1748 wrote to memory of 4808	1748	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
PID 1748 wrote to memory of 4808	1748	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
PID 1748 wrote to memory of 4808	1748	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe	42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
PID 2392 wrote to memory of 1772	2392	svassub	svassub
PID 2392 wrote to memory of 1772	2392	svassub	svassub
PID 2392 wrote to memory of 1772	2392	svassub	svassub
PID 2392 wrote to memory of 1772	2392	svassub	svassub
PID 2392 wrote to memory of 1772	2392	svassub	svassub
PID 2392 wrote to memory of 1772	2392	svassub	svassub

C:\Users\Admin\AppData\Local\Temp\42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
"C:\Users\Admin\AppData\Local\Temp\42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1748

C:\Users\Admin\AppData\Local\Temp\42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe
"C:\Users\Admin\AppData\Local\Temp\42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4808

C:\Users\Admin\AppData\Roaming\svassub
C:\Users\Admin\AppData\Roaming\svassub
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2392

C:\Users\Admin\AppData\Roaming\svassub
C:\Users\Admin\AppData\Roaming\svassub
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svassub
Filesize
145KB

MD5
25fb23643c5a4679391d6c9e76135c47

SHA1
30153cccd490635f53a751e99fde187bca7de95d

SHA256
42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6

SHA512
c463f36bb22b066bbc090159f9956cd56b31e1ac09b454df527bb8368d32cf01a7aa1601dc87c8e77bf084a518edb0c87234372e78367d7c2e4f95309d2652da

Download Submit
C:\Users\Admin\AppData\Roaming\svassub
Filesize
145KB

MD5
25fb23643c5a4679391d6c9e76135c47

SHA1
30153cccd490635f53a751e99fde187bca7de95d

SHA256
42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6

SHA512
c463f36bb22b066bbc090159f9956cd56b31e1ac09b454df527bb8368d32cf01a7aa1601dc87c8e77bf084a518edb0c87234372e78367d7c2e4f95309d2652da

Download Submit
C:\Users\Admin\AppData\Roaming\svassub
Filesize
145KB

MD5
25fb23643c5a4679391d6c9e76135c47

SHA1
30153cccd490635f53a751e99fde187bca7de95d

SHA256
42a70a93c7c3a214c4b2ad9b2828b27cf2b6cc256fec57efda197ae8f2fcb0e6

SHA512
c463f36bb22b066bbc090159f9956cd56b31e1ac09b454df527bb8368d32cf01a7aa1601dc87c8e77bf084a518edb0c87234372e78367d7c2e4f95309d2652da

Download Submit
memory/1748-139-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-137-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-124-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-125-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-126-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-127-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-140-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-129-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-130-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-131-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-132-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-133-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-134-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-135-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-136-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-142-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-138-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-143-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-128-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-123-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-120-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-144-0x0000000000460000-0x00000000005AA000-memory.dmp

Filesize
1.3MB

Download
memory/1748-145-0x0000000000460000-0x00000000005AA000-memory.dmp

Filesize
1.3MB

Download
memory/1748-146-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-147-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-148-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-149-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-150-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-121-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1748-122-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/1772-216-0x0000000000402DD8-mapping.dmp

Download
memory/1772-249-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1772-248-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2392-188-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/2392-187-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/2392-186-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/2392-185-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/2392-218-0x0000000000580000-0x0000000000589000-memory.dmp

Filesize
36KB

Download
memory/2392-189-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/2392-190-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-152-0x0000000000402DD8-mapping.dmp

Download
memory/4808-160-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-161-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-162-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-163-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-164-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-165-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-166-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4808-167-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-168-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-169-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-170-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-171-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-172-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-173-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-174-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-175-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-176-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-177-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-178-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-159-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-158-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-157-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-156-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-155-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-154-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-153-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-151-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4808-179-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-180-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-181-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-182-0x0000000076F50000-0x00000000770DE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-183-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download