smokeloader | abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b

General

Target

abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe
Size

321KB
MD5

c2b155f9dec61b43632e869de900458d
SHA1

4ee0bde8fece2ef592ffcd7b10739c7c1cc294a8
SHA256

abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b
SHA512

852e6efd0c380f74501b5ed45baa6f6438edc59e54ea45b29be0b92ec323d3409b2e32e6354c4293a99a9119a82403c15f82cb508106b5a616a3b4a1d8891705
SSDEEP

3072:3SzwInL8S2SDRKsC16ip2aGUHn9DyJA3jz0Tbb3IgQjmCC1//+sxA7rp2MV+v3:cZLV2SYsC+6n9DyIjz0TP3IhjxClRkq

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2596-133-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/5028-135-0x00000000021B0000-0x00000000021B9000-memory.dmp	family_smokeloader
behavioral1/memory/2596-136-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/2596-137-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe

description	pid	process	target process
PID 5028 set thread context of 2596	5028	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe

Modifies registry class 3 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe

pid	process
2596	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe
2596	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2632
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe

pid process

2596 abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe

pid	process
2632

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

2632
2632

pid	process
2632
2632

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe

description	pid	process	target process
PID 5028 wrote to memory of 2596	5028	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe
PID 5028 wrote to memory of 2596	5028	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe
PID 5028 wrote to memory of 2596	5028	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe
PID 5028 wrote to memory of 2596	5028	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe
PID 5028 wrote to memory of 2596	5028	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe
PID 5028 wrote to memory of 2596	5028	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe	abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe

C:\Users\Admin\AppData\Local\Temp\abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe
"C:\Users\Admin\AppData\Local\Temp\abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5028

C:\Users\Admin\AppData\Local\Temp\abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe
"C:\Users\Admin\AppData\Local\Temp\abcb00423144a19f0991926e80622590762c054da8e4e9f5c6c96ef5b203f03b.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2596

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2596-132-0x0000000000000000-mapping.dmp

Download
memory/2596-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2596-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2596-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5028-134-0x00000000006FE000-0x0000000000713000-memory.dmp

Filesize
84KB

Download
memory/5028-135-0x00000000021B0000-0x00000000021B9000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads