smokeloader | 3459b35320bc3edf6911ac3dcc837a47ed7536c40b9ed06c7e3ec1b78ef89e1e

Analysis

max time kernel
150s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17/03/2023, 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8de9d601eb2b1c2682dae1ade2c2aeb.exe
Size

173KB
MD5

c8de9d601eb2b1c2682dae1ade2c2aeb
SHA1

1d1637a7aed719eb0a39c8d68d4fa3a50b771b26
SHA256

3459b35320bc3edf6911ac3dcc837a47ed7536c40b9ed06c7e3ec1b78ef89e1e
SHA512

8bce1b2aecf934c1905d98f68be16cbb7ae969bf8a0aee4827d30eb9f6e2de47b14b3731c2ae4dc8d9ede73413c233347b614894a6d3d03a20a9de70e271dfab
SSDEEP

3072:uVsBUgUA0uAa3M3DTnMeLf4rGVwaQpYu1RIuMnBm/hVOndJB:/Bp2p3DbMAQrkXQ2Wt9/hEdJ

Score

10^/10

smokeloader lab backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

lab

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 1980	1992	c8de9d601eb2b1c2682dae1ade2c2aeb.exe	28

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c8de9d601eb2b1c2682dae1ade2c2aeb.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c8de9d601eb2b1c2682dae1ade2c2aeb.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c8de9d601eb2b1c2682dae1ade2c2aeb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1980	c8de9d601eb2b1c2682dae1ade2c2aeb.exe
1980	c8de9d601eb2b1c2682dae1ade2c2aeb.exe
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1244	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1980	c8de9d601eb2b1c2682dae1ade2c2aeb.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1980	1992	c8de9d601eb2b1c2682dae1ade2c2aeb.exe	28
PID 1992 wrote to memory of 1980	1992	c8de9d601eb2b1c2682dae1ade2c2aeb.exe	28
PID 1992 wrote to memory of 1980	1992	c8de9d601eb2b1c2682dae1ade2c2aeb.exe	28
PID 1992 wrote to memory of 1980	1992	c8de9d601eb2b1c2682dae1ade2c2aeb.exe	28
PID 1992 wrote to memory of 1980	1992	c8de9d601eb2b1c2682dae1ade2c2aeb.exe	28
PID 1992 wrote to memory of 1980	1992	c8de9d601eb2b1c2682dae1ade2c2aeb.exe	28
PID 1992 wrote to memory of 1980	1992	c8de9d601eb2b1c2682dae1ade2c2aeb.exe	28

C:\Users\Admin\AppData\Local\Temp\c8de9d601eb2b1c2682dae1ade2c2aeb.exe
"C:\Users\Admin\AppData\Local\Temp\c8de9d601eb2b1c2682dae1ade2c2aeb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\c8de9d601eb2b1c2682dae1ade2c2aeb.exe
  "C:\Users\Admin\AppData\Local\Temp\c8de9d601eb2b1c2682dae1ade2c2aeb.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-59-0x0000000002B50000-0x0000000002B66000-memory.dmp

Filesize
88KB

Download
memory/1980-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1980-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1980-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1980-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1992-57-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download