smokeloader | bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40

General

Target

bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40.exe
Size

218KB
MD5

0139b09e55c73d86375be0662c5674b9
SHA1

32c9ee8ac02ef2d8c6d49229c5891a96f983e487
SHA256

bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40
SHA512

a83854daeb1a27cecfaa1b119c2a6502c33b4dd7c55ded378e4e35a770bbc6bc1e1e10cdd86a042112300cfa77d0614a4af4414cb8f8320e8acc6ef5721de8fd
SSDEEP

3072:f9p8+LkEERQGHRACUE6zANxp/XMGyt3VW7b/FnlcNHCDml:fH8+Lk3Rge6k3WfVOtkCa

Score

10^/10

smokeloader systembc backdoor trojan

Malware Config

Extracted

Family

systembc

C2

109.205.214.18:443

Signatures

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4072-133-0x00000000005F0000-0x00000000005F9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

4527.exebsjptaw.exe

pid process

2224 4527.exe
3448 bsjptaw.exe
Drops file in Windows directory 2 IoCs

Processes:

4527.exe

description ioc process

File created C:\Windows\Tasks\bsjptaw.job 4527.exe
File opened for modification C:\Windows\Tasks\bsjptaw.job 4527.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1384 2224 WerFault.exe 4527.exe

pid	process
2224	4527.exe
3448	bsjptaw.exe

description	ioc	process
File created	C:\Windows\Tasks\bsjptaw.job	4527.exe
File opened for modification	C:\Windows\Tasks\bsjptaw.job	4527.exe

pid	pid_target	process	target process
1384	2224	WerFault.exe	4527.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40.exe

pid	process
4072	bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40.exe
4072	bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40.exe
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532
2532

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2532
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40.exe

pid process

4072 bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40.exe

pid	process
2532

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	2532
Token: SeCreatePagefilePrivilege	2532
Token: SeShutdownPrivilege	2532
Token: SeCreatePagefilePrivilege	2532
Token: SeShutdownPrivilege	2532
Token: SeCreatePagefilePrivilege	2532

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

2532

pid	process
2532

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

description	pid	target process
PID 2532 wrote to memory of 2224	2532	4527.exe
PID 2532 wrote to memory of 2224	2532	4527.exe
PID 2532 wrote to memory of 2224	2532	4527.exe

C:\Users\Admin\AppData\Local\Temp\bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40.exe
"C:\Users\Admin\AppData\Local\Temp\bbce2762d2cf06a4cbeae8b8eca305986c8ede78877bca908d80d522ac874f40.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4072

C:\Users\Admin\AppData\Local\Temp\4527.exe
C:\Users\Admin\AppData\Local\Temp\4527.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 492
2⤵
- Program crash
PID:1384

C:\ProgramData\helbkxl\bsjptaw.exe
C:\ProgramData\helbkxl\bsjptaw.exe start
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2224 -ip 2224
1⤵
PID:3732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\helbkxl\bsjptaw.exe
Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
C:\ProgramData\helbkxl\bsjptaw.exe
Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
C:\Users\Admin\AppData\Local\Temp\4527.exe
Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
C:\Users\Admin\AppData\Local\Temp\4527.exe
Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
memory/2224-140-0x00000000005B0000-0x00000000005B9000-memory.dmp

Filesize
36KB

Download
memory/2224-136-0x0000000000000000-mapping.dmp

Download
memory/2224-139-0x0000000000649000-0x000000000065A000-memory.dmp

Filesize
68KB

Download
memory/2224-141-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2224-146-0x0000000000649000-0x000000000065A000-memory.dmp

Filesize
68KB

Download
memory/2224-147-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3448-144-0x0000000000503000-0x0000000000513000-memory.dmp

Filesize
64KB

Download
memory/3448-145-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4072-135-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4072-133-0x00000000005F0000-0x00000000005F9000-memory.dmp

Filesize
36KB

Download
memory/4072-134-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4072-132-0x0000000000669000-0x0000000000679000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads