smokeloader | 42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef

Analysis

max time kernel
151s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2023 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe
Size

300KB
MD5

00d0869728651a7afdb4f7ba59699197
SHA1

c40baf73db73714c52597bc306d5e97f924f172f
SHA256

42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef
SHA512

833a578cbe474383649dc3ef9bf1e48502a377d0f8848480d3fe851fc08bf79f057300506b33ef409a1382494618b24f5b6a64905a2ff4b33fda31b8c557b54a
SSDEEP

6144:McWLB/ZXYp1yTUx/8aGHAZ+xOzzdaT8AuQj9sy3Ta:bW9/No1h8aGH/xOdaT8Alj7T

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4344-133-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/4888-135-0x0000000002200000-0x0000000002209000-memory.dmp	family_smokeloader
behavioral1/memory/4344-136-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral1/memory/4344-137-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe

description	pid	process	target process
PID 4888 set thread context of 4344	4888	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe

pid	process
4344	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe
4344	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2560
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe

pid process

4344 42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe

pid	process
2560

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe

description	pid	process	target process
PID 4888 wrote to memory of 4344	4888	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe
PID 4888 wrote to memory of 4344	4888	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe
PID 4888 wrote to memory of 4344	4888	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe
PID 4888 wrote to memory of 4344	4888	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe
PID 4888 wrote to memory of 4344	4888	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe
PID 4888 wrote to memory of 4344	4888	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe	42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe

C:\Users\Admin\AppData\Local\Temp\42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe
"C:\Users\Admin\AppData\Local\Temp\42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4888

C:\Users\Admin\AppData\Local\Temp\42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe
"C:\Users\Admin\AppData\Local\Temp\42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4344-132-0x0000000000000000-mapping.dmp

Download
memory/4344-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4344-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4344-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4888-134-0x000000000087E000-0x0000000000893000-memory.dmp

Filesize
84KB

Download
memory/4888-135-0x0000000002200000-0x0000000002209000-memory.dmp

Filesize
36KB

Download