smokeloader | eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605

General

Target

eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605.exe
Size

265KB
MD5

5a8415f7326f6542612327b5411b6a67
SHA1

d5915278feac694953077002e6213b397a5e6989
SHA256

eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605
SHA512

bc9308af2e28f792db6779fc4ee02e5f4049fedda0e1fc8ffb380c98dc0f1c36edcbc034ec23a90133ca346ec683eafd16e06338e8f0d4d8075c48526d5aa390
SSDEEP

3072:4jxrRHyW1rl2nLWQ7P9aW7SJCEwwf+cD726rApGisDdfK4DvL5kGOgCU3wsUfsX:qp5yWH2nLPJ7SJCqf+cG6ki1KCSG

Score

10^/10

smokeloader sprg backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 1 IoCs

Processes:

dbfejvc

pid process

4668 dbfejvc

pid	process
4668	dbfejvc

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605.exedbfejvc

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dbfejvc
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dbfejvc
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dbfejvc
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605.exe

pid	process
5076	eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605.exe
5076	eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605.exe
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3172

pid	process
3172

Suspicious behavior: MapViewOfSection 20 IoCs

Processes:

eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605.exedbfejvc

pid	process
5076	eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605.exe
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
3172
4668	dbfejvc

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

description	pid	target process
PID 3172 wrote to memory of 4520	3172	explorer.exe
PID 3172 wrote to memory of 4520	3172	explorer.exe
PID 3172 wrote to memory of 4520	3172	explorer.exe
PID 3172 wrote to memory of 4520	3172	explorer.exe
PID 3172 wrote to memory of 964	3172	explorer.exe
PID 3172 wrote to memory of 964	3172	explorer.exe
PID 3172 wrote to memory of 964	3172	explorer.exe
PID 3172 wrote to memory of 3528	3172	explorer.exe
PID 3172 wrote to memory of 3528	3172	explorer.exe
PID 3172 wrote to memory of 3528	3172	explorer.exe
PID 3172 wrote to memory of 3528	3172	explorer.exe
PID 3172 wrote to memory of 1832	3172	explorer.exe
PID 3172 wrote to memory of 1832	3172	explorer.exe
PID 3172 wrote to memory of 1832	3172	explorer.exe
PID 3172 wrote to memory of 4628	3172	explorer.exe
PID 3172 wrote to memory of 4628	3172	explorer.exe
PID 3172 wrote to memory of 4628	3172	explorer.exe
PID 3172 wrote to memory of 4628	3172	explorer.exe
PID 3172 wrote to memory of 1028	3172	explorer.exe
PID 3172 wrote to memory of 1028	3172	explorer.exe
PID 3172 wrote to memory of 1028	3172	explorer.exe
PID 3172 wrote to memory of 1028	3172	explorer.exe
PID 3172 wrote to memory of 3396	3172	explorer.exe
PID 3172 wrote to memory of 3396	3172	explorer.exe
PID 3172 wrote to memory of 3396	3172	explorer.exe
PID 3172 wrote to memory of 3396	3172	explorer.exe
PID 3172 wrote to memory of 3968	3172	explorer.exe
PID 3172 wrote to memory of 3968	3172	explorer.exe
PID 3172 wrote to memory of 3968	3172	explorer.exe
PID 3172 wrote to memory of 4440	3172	explorer.exe
PID 3172 wrote to memory of 4440	3172	explorer.exe
PID 3172 wrote to memory of 4440	3172	explorer.exe
PID 3172 wrote to memory of 4440	3172	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605.exe
"C:\Users\Admin\AppData\Local\Temp\eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5076

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4520

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:964

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3528

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1832

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4628

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1028

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3396

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3968

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4440

C:\Users\Admin\AppData\Roaming\dbfejvc
C:\Users\Admin\AppData\Roaming\dbfejvc
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\dbfejvc
Filesize
265KB

MD5
5a8415f7326f6542612327b5411b6a67

SHA1
d5915278feac694953077002e6213b397a5e6989

SHA256
eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605

SHA512
bc9308af2e28f792db6779fc4ee02e5f4049fedda0e1fc8ffb380c98dc0f1c36edcbc034ec23a90133ca346ec683eafd16e06338e8f0d4d8075c48526d5aa390

Download Submit
C:\Users\Admin\AppData\Roaming\dbfejvc
Filesize
265KB

MD5
5a8415f7326f6542612327b5411b6a67

SHA1
d5915278feac694953077002e6213b397a5e6989

SHA256
eda6d3ec29aef5cd7a2000d17efab7dcb710fcd0906357cb43a68cee6e9b7605

SHA512
bc9308af2e28f792db6779fc4ee02e5f4049fedda0e1fc8ffb380c98dc0f1c36edcbc034ec23a90133ca346ec683eafd16e06338e8f0d4d8075c48526d5aa390

Download Submit
memory/964-153-0x0000000000760000-0x000000000076F000-memory.dmp

Filesize
60KB

Download
memory/964-151-0x0000000000760000-0x000000000076F000-memory.dmp

Filesize
60KB

Download
memory/964-176-0x0000000000770000-0x0000000000779000-memory.dmp

Filesize
36KB

Download
memory/964-152-0x0000000000770000-0x0000000000779000-memory.dmp

Filesize
36KB

Download
memory/1028-180-0x00000000012A0000-0x00000000012A5000-memory.dmp

Filesize
20KB

Download
memory/1028-165-0x0000000001290000-0x0000000001299000-memory.dmp

Filesize
36KB

Download
memory/1028-163-0x0000000001290000-0x0000000001299000-memory.dmp

Filesize
36KB

Download
memory/1028-164-0x00000000012A0000-0x00000000012A5000-memory.dmp

Filesize
20KB

Download
memory/1832-178-0x0000000000710000-0x0000000000716000-memory.dmp

Filesize
24KB

Download
memory/1832-157-0x0000000000700000-0x000000000070C000-memory.dmp

Filesize
48KB

Download
memory/1832-158-0x0000000000710000-0x0000000000716000-memory.dmp

Filesize
24KB

Download
memory/1832-159-0x0000000000700000-0x000000000070C000-memory.dmp

Filesize
48KB

Download
memory/3172-187-0x0000000002D10000-0x0000000002D26000-memory.dmp

Filesize
88KB

Download
memory/3172-135-0x0000000002E60000-0x0000000002E76000-memory.dmp

Filesize
88KB

Download
memory/3396-181-0x0000000001280000-0x0000000001286000-memory.dmp

Filesize
24KB

Download
memory/3396-166-0x0000000001270000-0x000000000127B000-memory.dmp

Filesize
44KB

Download
memory/3396-167-0x0000000001280000-0x0000000001286000-memory.dmp

Filesize
24KB

Download
memory/3396-168-0x0000000001270000-0x000000000127B000-memory.dmp

Filesize
44KB

Download
memory/3528-155-0x0000000000DA0000-0x0000000000DA5000-memory.dmp

Filesize
20KB

Download
memory/3528-156-0x0000000000D90000-0x0000000000D99000-memory.dmp

Filesize
36KB

Download
memory/3528-154-0x0000000000D90000-0x0000000000D99000-memory.dmp

Filesize
36KB

Download
memory/3528-177-0x0000000000DA0000-0x0000000000DA5000-memory.dmp

Filesize
20KB

Download
memory/3968-171-0x0000000000A10000-0x0000000000A1D000-memory.dmp

Filesize
52KB

Download
memory/3968-170-0x0000000000A20000-0x0000000000A27000-memory.dmp

Filesize
28KB

Download
memory/3968-182-0x0000000000A20000-0x0000000000A27000-memory.dmp

Filesize
28KB

Download
memory/3968-169-0x0000000000A10000-0x0000000000A1D000-memory.dmp

Filesize
52KB

Download
memory/4440-174-0x0000000001020000-0x000000000102B000-memory.dmp

Filesize
44KB

Download
memory/4440-172-0x0000000001020000-0x000000000102B000-memory.dmp

Filesize
44KB

Download
memory/4440-173-0x0000000001030000-0x0000000001038000-memory.dmp

Filesize
32KB

Download
memory/4440-183-0x0000000001030000-0x0000000001038000-memory.dmp

Filesize
32KB

Download
memory/4520-150-0x00000000004E0000-0x00000000004EB000-memory.dmp

Filesize
44KB

Download
memory/4520-175-0x00000000004F0000-0x00000000004F7000-memory.dmp

Filesize
28KB

Download
memory/4520-148-0x00000000004E0000-0x00000000004EB000-memory.dmp

Filesize
44KB

Download
memory/4520-149-0x00000000004F0000-0x00000000004F7000-memory.dmp

Filesize
28KB

Download
memory/4628-160-0x00000000003D0000-0x00000000003F7000-memory.dmp

Filesize
156KB

Download
memory/4628-162-0x00000000003D0000-0x00000000003F7000-memory.dmp

Filesize
156KB

Download
memory/4628-161-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4628-179-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4668-190-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/5076-134-0x00000000008A0000-0x00000000008A9000-memory.dmp

Filesize
36KB

Download
memory/5076-137-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads