smokeloader | f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408

General

Target

f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408.exe
Size

265KB
MD5

fef570cafc077e302fd07b2dd59e7265
SHA1

1486ba4af2bbe43aa7334fdd03ff80b2777fc497
SHA256

f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408
SHA512

627afc69aa15e278b5dee0161df92516ca88fd7d5a9a44882bd861a2ca39944ce73a6a9e1e12c2cdedd1356ea8640a697368120174d9f5348c98152faef852ff
SSDEEP

3072:AjO8RHyGl/COeLQO7+g1WFcSmASjXp15Q0K7Qnx/YL5ktQCU3wsUfsX:CJ5yG8OeLrYFcS70Xp1m0Kox/R

Score

10^/10

smokeloader sprg backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408.exe

pid	process
4568	f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408.exe
4568	f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408.exe
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3160

pid	process
3160

Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408.exe

pid	process
4568	f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408.exe
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

description	pid	target process
PID 3160 wrote to memory of 3904	3160	explorer.exe
PID 3160 wrote to memory of 3904	3160	explorer.exe
PID 3160 wrote to memory of 3904	3160	explorer.exe
PID 3160 wrote to memory of 3904	3160	explorer.exe
PID 3160 wrote to memory of 3564	3160	explorer.exe
PID 3160 wrote to memory of 3564	3160	explorer.exe
PID 3160 wrote to memory of 3564	3160	explorer.exe
PID 3160 wrote to memory of 4896	3160	explorer.exe
PID 3160 wrote to memory of 4896	3160	explorer.exe
PID 3160 wrote to memory of 4896	3160	explorer.exe
PID 3160 wrote to memory of 4896	3160	explorer.exe
PID 3160 wrote to memory of 4748	3160	explorer.exe
PID 3160 wrote to memory of 4748	3160	explorer.exe
PID 3160 wrote to memory of 4748	3160	explorer.exe
PID 3160 wrote to memory of 4844	3160	explorer.exe
PID 3160 wrote to memory of 4844	3160	explorer.exe
PID 3160 wrote to memory of 4844	3160	explorer.exe
PID 3160 wrote to memory of 4844	3160	explorer.exe
PID 3160 wrote to memory of 3248	3160	explorer.exe
PID 3160 wrote to memory of 3248	3160	explorer.exe
PID 3160 wrote to memory of 3248	3160	explorer.exe
PID 3160 wrote to memory of 3248	3160	explorer.exe
PID 3160 wrote to memory of 3580	3160	explorer.exe
PID 3160 wrote to memory of 3580	3160	explorer.exe
PID 3160 wrote to memory of 3580	3160	explorer.exe
PID 3160 wrote to memory of 3580	3160	explorer.exe
PID 3160 wrote to memory of 3620	3160	explorer.exe
PID 3160 wrote to memory of 3620	3160	explorer.exe
PID 3160 wrote to memory of 3620	3160	explorer.exe
PID 3160 wrote to memory of 1724	3160	explorer.exe
PID 3160 wrote to memory of 1724	3160	explorer.exe
PID 3160 wrote to memory of 1724	3160	explorer.exe
PID 3160 wrote to memory of 1724	3160	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408.exe
"C:\Users\Admin\AppData\Local\Temp\f0f32bfe6277bb7d507e9ac7ffc72c85230e99352168136d66cc73e5898cd408.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4568

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3904

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3564

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4896

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4748

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4844

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3248

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3580

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3620

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-169-0x0000000000C60000-0x0000000000C6B000-memory.dmp

Filesize
44KB

Download
memory/1724-178-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/1724-171-0x0000000000C60000-0x0000000000C6B000-memory.dmp

Filesize
44KB

Download
memory/1724-170-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/3160-135-0x0000000000E60000-0x0000000000E76000-memory.dmp

Filesize
88KB

Download
memory/3248-161-0x00000000010C0000-0x00000000010E7000-memory.dmp

Filesize
156KB

Download
memory/3248-162-0x0000000000820000-0x0000000000829000-memory.dmp

Filesize
36KB

Download
memory/3248-160-0x0000000000820000-0x0000000000829000-memory.dmp

Filesize
36KB

Download
memory/3248-176-0x00000000010C0000-0x00000000010E7000-memory.dmp

Filesize
156KB

Download
memory/3564-150-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download
memory/3564-151-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download
memory/3564-149-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download
memory/3580-165-0x0000000000800000-0x000000000080B000-memory.dmp

Filesize
44KB

Download
memory/3580-164-0x0000000000820000-0x0000000000829000-memory.dmp

Filesize
36KB

Download
memory/3580-163-0x0000000000800000-0x000000000080B000-memory.dmp

Filesize
44KB

Download
memory/3620-167-0x0000000000800000-0x000000000080B000-memory.dmp

Filesize
44KB

Download
memory/3620-166-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/3620-168-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/3620-177-0x0000000000800000-0x000000000080B000-memory.dmp

Filesize
44KB

Download
memory/3904-147-0x0000000000890000-0x0000000000899000-memory.dmp

Filesize
36KB

Download
memory/3904-148-0x0000000000900000-0x000000000090B000-memory.dmp

Filesize
44KB

Download
memory/3904-172-0x0000000000890000-0x0000000000899000-memory.dmp

Filesize
36KB

Download
memory/3904-146-0x0000000000900000-0x000000000090B000-memory.dmp

Filesize
44KB

Download
memory/4568-136-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/4568-134-0x0000000000890000-0x0000000000899000-memory.dmp

Filesize
36KB

Download
memory/4748-156-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/4748-155-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/4748-153-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/4844-157-0x00000000010C0000-0x00000000010E7000-memory.dmp

Filesize
156KB

Download
memory/4844-158-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/4844-175-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/4844-159-0x00000000010C0000-0x00000000010E7000-memory.dmp

Filesize
156KB

Download
memory/4896-154-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/4896-173-0x0000000000430000-0x0000000000439000-memory.dmp

Filesize
36KB

Download
memory/4896-174-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/4896-152-0x0000000000430000-0x0000000000439000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads