smokeloader | 882b546df09bb09b7d70a717a73c257d0684bae574160de290438cca6bf8ba9c

Analysis

max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2022, 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

842f4b4369331da215a52c5af21720d30d799557e41e493892f76078c18a4b49.exe
Size

223KB
MD5

bfbfca5f9c558bf3171f999ba3459d12
SHA1

ced296dd2fa34b9b52cdb01e238af34dd8414399
SHA256

842f4b4369331da215a52c5af21720d30d799557e41e493892f76078c18a4b49
SHA512

59150c481eb0544897b09c53f52cd00f1068f410234c947ab24e96948713d6fb129ac01a98a747d84d918003555c7177e1cf40abd1cb099e2fb0d43ec0ca72a1
SSDEEP

3072:WDwILGHLb55+98kVwAgmv9LKxW42MLauDgI7H4f/ln:qLGrfkgm1XMLaMgIS

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/1912-133-0x00000000006F0000-0x00000000006F9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
1788	DB5C.exe
484	DEE7.exe
3752	E418.exe
2648	F2B0.exe
832	F6D7.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2648	F2B0.exe
2648	F2B0.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	842f4b4369331da215a52c5af21720d30d799557e41e493892f76078c18a4b49.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	842f4b4369331da215a52c5af21720d30d799557e41e493892f76078c18a4b49.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	842f4b4369331da215a52c5af21720d30d799557e41e493892f76078c18a4b49.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1912	842f4b4369331da215a52c5af21720d30d799557e41e493892f76078c18a4b49.exe
1912	842f4b4369331da215a52c5af21720d30d799557e41e493892f76078c18a4b49.exe
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2016	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
1912	842f4b4369331da215a52c5af21720d30d799557e41e493892f76078c18a4b49.exe
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found
2016	Process not Found

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1788	2016	Process not Found	88
PID 2016 wrote to memory of 1788	2016	Process not Found	88
PID 2016 wrote to memory of 484	2016	Process not Found	89
PID 2016 wrote to memory of 484	2016	Process not Found	89
PID 2016 wrote to memory of 3752	2016	Process not Found	90
PID 2016 wrote to memory of 3752	2016	Process not Found	90
PID 2016 wrote to memory of 3752	2016	Process not Found	90
PID 3752 wrote to memory of 4280	3752	E418.exe	91
PID 3752 wrote to memory of 4280	3752	E418.exe	91
PID 3752 wrote to memory of 4280	3752	E418.exe	91
PID 3752 wrote to memory of 3352	3752	E418.exe	92
PID 3752 wrote to memory of 3352	3752	E418.exe	92
PID 3752 wrote to memory of 3352	3752	E418.exe	92
PID 3752 wrote to memory of 3872	3752	E418.exe	93
PID 3752 wrote to memory of 3872	3752	E418.exe	93
PID 3752 wrote to memory of 3872	3752	E418.exe	93
PID 3752 wrote to memory of 4456	3752	E418.exe	94
PID 3752 wrote to memory of 4456	3752	E418.exe	94
PID 3752 wrote to memory of 4456	3752	E418.exe	94
PID 2016 wrote to memory of 2648	2016	Process not Found	95
PID 2016 wrote to memory of 2648	2016	Process not Found	95
PID 2016 wrote to memory of 2648	2016	Process not Found	95
PID 2016 wrote to memory of 832	2016	Process not Found	96
PID 2016 wrote to memory of 832	2016	Process not Found	96
PID 2016 wrote to memory of 2808	2016	Process not Found	97
PID 2016 wrote to memory of 2808	2016	Process not Found	97
PID 2016 wrote to memory of 2808	2016	Process not Found	97
PID 2016 wrote to memory of 2808	2016	Process not Found	97
PID 2016 wrote to memory of 4404	2016	Process not Found	98
PID 2016 wrote to memory of 4404	2016	Process not Found	98
PID 2016 wrote to memory of 4404	2016	Process not Found	98
PID 2016 wrote to memory of 1604	2016	Process not Found	99
PID 2016 wrote to memory of 1604	2016	Process not Found	99
PID 2016 wrote to memory of 1604	2016	Process not Found	99
PID 2016 wrote to memory of 1604	2016	Process not Found	99
PID 2016 wrote to memory of 384	2016	Process not Found	100
PID 2016 wrote to memory of 384	2016	Process not Found	100
PID 2016 wrote to memory of 384	2016	Process not Found	100
PID 2016 wrote to memory of 4852	2016	Process not Found	101
PID 2016 wrote to memory of 4852	2016	Process not Found	101
PID 2016 wrote to memory of 4852	2016	Process not Found	101
PID 2016 wrote to memory of 4852	2016	Process not Found	101
PID 2016 wrote to memory of 3692	2016	Process not Found	102
PID 2016 wrote to memory of 3692	2016	Process not Found	102
PID 2016 wrote to memory of 3692	2016	Process not Found	102
PID 2016 wrote to memory of 3692	2016	Process not Found	102
PID 2016 wrote to memory of 3324	2016	Process not Found	103
PID 2016 wrote to memory of 3324	2016	Process not Found	103
PID 2016 wrote to memory of 3324	2016	Process not Found	103
PID 2016 wrote to memory of 3324	2016	Process not Found	103
PID 2016 wrote to memory of 2388	2016	Process not Found	104
PID 2016 wrote to memory of 2388	2016	Process not Found	104
PID 2016 wrote to memory of 2388	2016	Process not Found	104
PID 2016 wrote to memory of 2040	2016	Process not Found	105
PID 2016 wrote to memory of 2040	2016	Process not Found	105
PID 2016 wrote to memory of 2040	2016	Process not Found	105
PID 2016 wrote to memory of 2040	2016	Process not Found	105

C:\Users\Admin\AppData\Local\Temp\842f4b4369331da215a52c5af21720d30d799557e41e493892f76078c18a4b49.exe
"C:\Users\Admin\AppData\Local\Temp\842f4b4369331da215a52c5af21720d30d799557e41e493892f76078c18a4b49.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1912

C:\Users\Admin\AppData\Local\Temp\DB5C.exe
C:\Users\Admin\AppData\Local\Temp\DB5C.exe
1⤵
- Executes dropped EXE
PID:1788

C:\Users\Admin\AppData\Local\Temp\DEE7.exe
C:\Users\Admin\AppData\Local\Temp\DEE7.exe
1⤵
- Executes dropped EXE
PID:484

C:\Users\Admin\AppData\Local\Temp\E418.exe
C:\Users\Admin\AppData\Local\Temp\E418.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4456

C:\Users\Admin\AppData\Local\Temp\F2B0.exe
C:\Users\Admin\AppData\Local\Temp\F2B0.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2648

C:\Users\Admin\AppData\Local\Temp\F6D7.exe
C:\Users\Admin\AppData\Local\Temp\F6D7.exe
1⤵
- Executes dropped EXE
PID:832

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2808

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4404

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1604

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:384

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4852

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3692

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3324

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2388

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DB5C.exe

Filesize
4KB

MD5
9748489855d9dd82ab09da5e3e55b19e

SHA1
6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

SHA256
05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

SHA512
7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB5C.exe

Filesize
4KB

MD5
9748489855d9dd82ab09da5e3e55b19e

SHA1
6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

SHA256
05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

SHA512
7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\DEE7.exe

Filesize
4KB

MD5
9748489855d9dd82ab09da5e3e55b19e

SHA1
6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

SHA256
05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

SHA512
7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\DEE7.exe

Filesize
4KB

MD5
9748489855d9dd82ab09da5e3e55b19e

SHA1
6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

SHA256
05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

SHA512
7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\E418.exe

Filesize
67KB

MD5
666d8f33d37064fd5d14e2166c9bfa69

SHA1
3b27df9335a9b2efe9da1057e9f8312a72d1ca9d

SHA256
7fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157

SHA512
ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df

Download Submit
C:\Users\Admin\AppData\Local\Temp\E418.exe

Filesize
67KB

MD5
666d8f33d37064fd5d14e2166c9bfa69

SHA1
3b27df9335a9b2efe9da1057e9f8312a72d1ca9d

SHA256
7fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157

SHA512
ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df

Download Submit
C:\Users\Admin\AppData\Local\Temp\F2B0.exe

Filesize
7.1MB

MD5
966f073e12a35e753274f997470eaa4e

SHA1
e03ae059acac6f3ef90aee6f4d0bac01e5d0276b

SHA256
5590ca1e89f119cd5aee142c844cda83c53bc848616d04a4aa98fc3efbce4c31

SHA512
7fee4a970590a803df528a3ef12344d3127f3ce9f948656ad52fee6e60ef9e3cd7abb7b9005f64c016d826cc351896092930d6287f68168c67724537c2592ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\F2B0.exe

Filesize
7.1MB

MD5
966f073e12a35e753274f997470eaa4e

SHA1
e03ae059acac6f3ef90aee6f4d0bac01e5d0276b

SHA256
5590ca1e89f119cd5aee142c844cda83c53bc848616d04a4aa98fc3efbce4c31

SHA512
7fee4a970590a803df528a3ef12344d3127f3ce9f948656ad52fee6e60ef9e3cd7abb7b9005f64c016d826cc351896092930d6287f68168c67724537c2592ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\F6D7.exe

Filesize
4KB

MD5
9748489855d9dd82ab09da5e3e55b19e

SHA1
6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

SHA256
05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

SHA512
7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\F6D7.exe

Filesize
4KB

MD5
9748489855d9dd82ab09da5e3e55b19e

SHA1
6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

SHA256
05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

SHA512
7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

Download Submit
memory/384-173-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/384-194-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/384-174-0x0000000000520000-0x000000000052C000-memory.dmp

Filesize
48KB

Download
memory/484-144-0x00007FFB15B60000-0x00007FFB16621000-memory.dmp

Filesize
10.8MB

Download
memory/484-176-0x00007FFB15B60000-0x00007FFB16621000-memory.dmp

Filesize
10.8MB

Download
memory/832-160-0x00007FFB15B60000-0x00007FFB16621000-memory.dmp

Filesize
10.8MB

Download
memory/1604-171-0x0000000000830000-0x0000000000839000-memory.dmp

Filesize
36KB

Download
memory/1604-170-0x0000000000840000-0x0000000000845000-memory.dmp

Filesize
20KB

Download
memory/1604-193-0x0000000000840000-0x0000000000845000-memory.dmp

Filesize
20KB

Download
memory/1788-140-0x00007FFB15B60000-0x00007FFB16621000-memory.dmp

Filesize
10.8MB

Download
memory/1788-139-0x0000000000EE0000-0x0000000000EE8000-memory.dmp

Filesize
32KB

Download
memory/1912-132-0x000000000075A000-0x000000000076A000-memory.dmp

Filesize
64KB

Download
memory/1912-134-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1912-133-0x00000000006F0000-0x00000000006F9000-memory.dmp

Filesize
36KB

Download
memory/1912-135-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2040-189-0x0000000000730000-0x0000000000738000-memory.dmp

Filesize
32KB

Download
memory/2040-199-0x0000000000730000-0x0000000000738000-memory.dmp

Filesize
32KB

Download
memory/2040-188-0x0000000000720000-0x000000000072B000-memory.dmp

Filesize
44KB

Download
memory/2388-198-0x0000000000780000-0x0000000000787000-memory.dmp

Filesize
28KB

Download
memory/2388-186-0x0000000000780000-0x0000000000787000-memory.dmp

Filesize
28KB

Download
memory/2388-187-0x0000000000770000-0x000000000077D000-memory.dmp

Filesize
52KB

Download
memory/2648-163-0x0000000000400000-0x0000000000F48000-memory.dmp

Filesize
11.3MB

Download
memory/2648-191-0x0000000000400000-0x0000000000F48000-memory.dmp

Filesize
11.3MB

Download
memory/2648-200-0x0000000000400000-0x0000000000F48000-memory.dmp

Filesize
11.3MB

Download
memory/2808-162-0x0000000000890000-0x0000000000897000-memory.dmp

Filesize
28KB

Download
memory/2808-164-0x0000000000880000-0x000000000088B000-memory.dmp

Filesize
44KB

Download
memory/2808-190-0x0000000000890000-0x0000000000897000-memory.dmp

Filesize
28KB

Download
memory/3324-182-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/3324-183-0x00000000006A0000-0x00000000006AB000-memory.dmp

Filesize
44KB

Download
memory/3324-197-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/3692-180-0x0000000000960000-0x0000000000969000-memory.dmp

Filesize
36KB

Download
memory/3692-196-0x0000000000970000-0x0000000000975000-memory.dmp

Filesize
20KB

Download
memory/3752-149-0x0000000004B90000-0x0000000004BF6000-memory.dmp

Filesize
408KB

Download
memory/3752-148-0x0000000000380000-0x0000000000396000-memory.dmp

Filesize
88KB

Download
memory/4404-168-0x0000000000EB0000-0x0000000000EBF000-memory.dmp

Filesize
60KB

Download
memory/4404-167-0x0000000000EC0000-0x0000000000EC9000-memory.dmp

Filesize
36KB

Download
memory/4404-192-0x0000000000EC0000-0x0000000000EC9000-memory.dmp

Filesize
36KB

Download
memory/4852-195-0x0000000000870000-0x0000000000892000-memory.dmp

Filesize
136KB

Download
memory/4852-177-0x0000000000870000-0x0000000000892000-memory.dmp

Filesize
136KB

Download
memory/4852-178-0x0000000000840000-0x0000000000867000-memory.dmp

Filesize
156KB

Download