smokeloader | 3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c

General

Target

3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c.exe
Size

281KB
MD5

e28bb0c12be9480d98e49fce8cced7b6
SHA1

e7f2fb2ebdcd1f416422ecfc9a2e3bdf4dc2e845
SHA256

3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c
SHA512

a2edcf059ec2787c20940913c674e86e19047147c5574d129f6126d4e53c90be24526ac61f146bcab8d678f60ce4e9c017a11309921cd23642d501c9b2f78578
SSDEEP

3072:d5lYIMAbKnUtNBizA3DAbxk57Ei3LSmPI0DnMOC4YMA5ydszTgXl:2IMVUtrrl7BDnMf4HA0

Score

10^/10

smokeloader systembc backdoor persistence trojan

Malware Config

Extracted

Family

systembc

C2

admex1955x.xyz:4044

servx2785x.xyz:4044

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

wosi.exewosi.exe

pid process

1284 wosi.exe
1548 wosi.exe

pid	process
1284	wosi.exe
1548	wosi.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c.exe'\""	3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run	3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

wosi.exe

description pid process target process

PID 1284 set thread context of 1548 1284 wosi.exe wosi.exe
Drops file in Windows directory 1 IoCs

Processes:

3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c.exe

description ioc process

File created C:\Windows\Tasks\jqmgixifdfaiapaecep.job 3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c.exe

description	pid	process	target process
PID 1284 set thread context of 1548	1284	wosi.exe	wosi.exe

description	ioc	process
File created	C:\Windows\Tasks\jqmgixifdfaiapaecep.job	3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wosi.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wosi.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wosi.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wosi.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

wosi.exe

pid process

1548 wosi.exe
1548 wosi.exe

pid	process
1548	wosi.exe
1548	wosi.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

taskeng.exewosi.exe

description	pid	process	target process
PID 916 wrote to memory of 1284	916	taskeng.exe	wosi.exe
PID 916 wrote to memory of 1284	916	taskeng.exe	wosi.exe
PID 916 wrote to memory of 1284	916	taskeng.exe	wosi.exe
PID 916 wrote to memory of 1284	916	taskeng.exe	wosi.exe
PID 1284 wrote to memory of 1548	1284	wosi.exe	wosi.exe
PID 1284 wrote to memory of 1548	1284	wosi.exe	wosi.exe
PID 1284 wrote to memory of 1548	1284	wosi.exe	wosi.exe
PID 1284 wrote to memory of 1548	1284	wosi.exe	wosi.exe
PID 1284 wrote to memory of 1548	1284	wosi.exe	wosi.exe
PID 1284 wrote to memory of 1548	1284	wosi.exe	wosi.exe
PID 1284 wrote to memory of 1548	1284	wosi.exe	wosi.exe

C:\Users\Admin\AppData\Local\Temp\3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c.exe
"C:\Users\Admin\AppData\Local\Temp\3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:2024

C:\Windows\system32\taskeng.exe
taskeng.exe {3A17CC62-DE82-43CE-92E3-B8EC26B196E1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Users\Admin\AppData\Local\Temp\wosi.exe
C:\Users\Admin\AppData\Local\Temp\wosi.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1284

C:\Users\Admin\AppData\Local\Temp\wosi.exe
C:\Users\Admin\AppData\Local\Temp\wosi.exe
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wosi.exe
Filesize
281KB

MD5
9769c181ecef69544bbb2f974b8c0e10

SHA1
5d0f447f4ccc89d7d79c0565372195240cdfa25f

SHA256
e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0

SHA512
b3da8fea6ee5d6b67f55a4043f18d7325f1700c9f3dcb0e7cbf21f49ebdbb56b5a10a2d03153d0dfb1e8dc34db20cdea0236c448f2c361fadbabf9a6f59b4c7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wosi.exe
Filesize
281KB

MD5
9769c181ecef69544bbb2f974b8c0e10

SHA1
5d0f447f4ccc89d7d79c0565372195240cdfa25f

SHA256
e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0

SHA512
b3da8fea6ee5d6b67f55a4043f18d7325f1700c9f3dcb0e7cbf21f49ebdbb56b5a10a2d03153d0dfb1e8dc34db20cdea0236c448f2c361fadbabf9a6f59b4c7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wosi.exe
Filesize
281KB

MD5
9769c181ecef69544bbb2f974b8c0e10

SHA1
5d0f447f4ccc89d7d79c0565372195240cdfa25f

SHA256
e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0

SHA512
b3da8fea6ee5d6b67f55a4043f18d7325f1700c9f3dcb0e7cbf21f49ebdbb56b5a10a2d03153d0dfb1e8dc34db20cdea0236c448f2c361fadbabf9a6f59b4c7a

Download Submit
memory/1284-83-0x00000000001D0000-0x00000000001D9000-memory.dmp

Filesize
36KB

Download
memory/1548-81-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1548-80-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1548-84-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1548-86-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2024-54-0x0000000000220000-0x0000000000235000-memory.dmp

Filesize
84KB

Download
memory/2024-55-0x0000000000240000-0x0000000000245000-memory.dmp

Filesize
20KB

Download
memory/2024-56-0x0000000000400000-0x000000000092B000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads