smokeloader | b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068

Analysis

max time kernel
170s
max time network
148s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
29-11-2022 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
Size

146KB
MD5

154bc7a96a9bd108766373524d09d10d
SHA1

7219c69706dbc5f6404e216e605cc157805aee20
SHA256

b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068
SHA512

18501da0e0d75e2ce3c9cc2e1d9c7813b3228b1a098f5af7d6239a1aa9adc5280c5e3ecb54ca46f41c1f68d5cb4be8b729b2315c03f1ccd2e9b4f271648a2594
SSDEEP

1536:0BDdkrxlw3oF9Jp9SQj4dD8GMndfdy28Up5gYmDOomE+wTj62qrRTB69dsnWw4SP:6Ddb3oJndw28Up5QY2ogK4ShOUAW

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4740-144-0x00000000007D0000-0x00000000007D9000-memory.dmp	family_smokeloader
behavioral1/memory/1612-149-0x0000000000402DD8-mapping.dmp	family_smokeloader
behavioral1/memory/1612-148-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/1612-158-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/1612-181-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/2996-213-0x0000000000402DD8-mapping.dmp	family_smokeloader
behavioral1/memory/2996-245-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 2 IoCs

Processes:

cebvfrwcebvfrw

pid process

4232 cebvfrw
2996 cebvfrw
Deletes itself 1 IoCs

Processes:

pid process

3048

pid	process
4232	cebvfrw
2996	cebvfrw

pid	process
3048

Suspicious use of SetThreadContext 2 IoCs

Processes:

b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.execebvfrw

description	pid	process	target process
PID 4740 set thread context of 1612	4740	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
PID 4232 set thread context of 2996	4232	cebvfrw	cebvfrw

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cebvfrwb0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cebvfrw
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cebvfrw
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cebvfrw

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe

pid	process
1612	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
1612	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3048
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe

pid process

1612 b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 3048
Token: SeCreatePagefilePrivilege 3048

pid	process
3048

description	pid	process
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.execebvfrw

description	pid	process	target process
PID 4740 wrote to memory of 1612	4740	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
PID 4740 wrote to memory of 1612	4740	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
PID 4740 wrote to memory of 1612	4740	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
PID 4740 wrote to memory of 1612	4740	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
PID 4740 wrote to memory of 1612	4740	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
PID 4740 wrote to memory of 1612	4740	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe	b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
PID 4232 wrote to memory of 2996	4232	cebvfrw	cebvfrw
PID 4232 wrote to memory of 2996	4232	cebvfrw	cebvfrw
PID 4232 wrote to memory of 2996	4232	cebvfrw	cebvfrw
PID 4232 wrote to memory of 2996	4232	cebvfrw	cebvfrw
PID 4232 wrote to memory of 2996	4232	cebvfrw	cebvfrw
PID 4232 wrote to memory of 2996	4232	cebvfrw	cebvfrw

C:\Users\Admin\AppData\Local\Temp\b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
"C:\Users\Admin\AppData\Local\Temp\b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4740

C:\Users\Admin\AppData\Local\Temp\b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe
"C:\Users\Admin\AppData\Local\Temp\b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1612

C:\Users\Admin\AppData\Roaming\cebvfrw
C:\Users\Admin\AppData\Roaming\cebvfrw
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4232

C:\Users\Admin\AppData\Roaming\cebvfrw
C:\Users\Admin\AppData\Roaming\cebvfrw
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\cebvfrw
Filesize
146KB

MD5
154bc7a96a9bd108766373524d09d10d

SHA1
7219c69706dbc5f6404e216e605cc157805aee20

SHA256
b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068

SHA512
18501da0e0d75e2ce3c9cc2e1d9c7813b3228b1a098f5af7d6239a1aa9adc5280c5e3ecb54ca46f41c1f68d5cb4be8b729b2315c03f1ccd2e9b4f271648a2594

Download Submit
C:\Users\Admin\AppData\Roaming\cebvfrw
Filesize
146KB

MD5
154bc7a96a9bd108766373524d09d10d

SHA1
7219c69706dbc5f6404e216e605cc157805aee20

SHA256
b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068

SHA512
18501da0e0d75e2ce3c9cc2e1d9c7813b3228b1a098f5af7d6239a1aa9adc5280c5e3ecb54ca46f41c1f68d5cb4be8b729b2315c03f1ccd2e9b4f271648a2594

Download Submit
C:\Users\Admin\AppData\Roaming\cebvfrw
Filesize
146KB

MD5
154bc7a96a9bd108766373524d09d10d

SHA1
7219c69706dbc5f6404e216e605cc157805aee20

SHA256
b0135e213cbca3b2ffc49f2fa65d8d39a4d44d85866f501642eb47aa2ba5d068

SHA512
18501da0e0d75e2ce3c9cc2e1d9c7813b3228b1a098f5af7d6239a1aa9adc5280c5e3ecb54ca46f41c1f68d5cb4be8b729b2315c03f1ccd2e9b4f271648a2594

Download Submit
memory/1612-174-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-155-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-158-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-181-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-180-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-157-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-179-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-178-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-177-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-176-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-175-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-173-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-171-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-172-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-170-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-169-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-167-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-166-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-165-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-164-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-156-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-149-0x0000000000402DD8-mapping.dmp

Download
memory/1612-148-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-150-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-153-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-152-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/1612-154-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2996-213-0x0000000000402DD8-mapping.dmp

Download
memory/2996-245-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4232-183-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4232-222-0x0000000000779000-0x000000000078A000-memory.dmp

Filesize
68KB

Download
memory/4232-188-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4232-187-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4232-186-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4232-185-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4232-184-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-131-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-128-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-140-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-139-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-138-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-137-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-135-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-136-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-134-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-133-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-151-0x000000000084A000-0x000000000085A000-memory.dmp

Filesize
64KB

Download
memory/4740-132-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-118-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-130-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-129-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-141-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-127-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-125-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-124-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-121-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-142-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-143-0x000000000084A000-0x000000000085A000-memory.dmp

Filesize
64KB

Download
memory/4740-144-0x00000000007D0000-0x00000000007D9000-memory.dmp

Filesize
36KB

Download
memory/4740-145-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-120-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-122-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-123-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-119-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-126-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4740-147-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download