smokeloader | e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0

Analysis

max time kernel
150s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-06-2023 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9769c181ecef69544bbb2f974b8c0e10.exe
Size

281KB
MD5

9769c181ecef69544bbb2f974b8c0e10
SHA1

5d0f447f4ccc89d7d79c0565372195240cdfa25f
SHA256

e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0
SHA512

b3da8fea6ee5d6b67f55a4043f18d7325f1700c9f3dcb0e7cbf21f49ebdbb56b5a10a2d03153d0dfb1e8dc34db20cdea0236c448f2c361fadbabf9a6f59b4c7a
SSDEEP

3072:Z5SXIMALRKEttgCWAbi1D1fJmxIV0BN3omE9MA5yXsztcJe9:GIMpEtCCWAbiBRmE9o6

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://serverlogs37.xyz/statweb255/

http://servblog757.xyz/statweb255/

http://dexblog45.xyz/statweb255/

http://admlogs.online/statweb255/

http://blogstat355.xyz/statweb255/

http://blogstatserv25.xyz/statweb255/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

9769c181ecef69544bbb2f974b8c0e10.exe

description pid process target process

PID 1356 set thread context of 1396 1356 9769c181ecef69544bbb2f974b8c0e10.exe 9769c181ecef69544bbb2f974b8c0e10.exe

description	pid	process	target process
PID 1356 set thread context of 1396	1356	9769c181ecef69544bbb2f974b8c0e10.exe	9769c181ecef69544bbb2f974b8c0e10.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9769c181ecef69544bbb2f974b8c0e10.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9769c181ecef69544bbb2f974b8c0e10.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9769c181ecef69544bbb2f974b8c0e10.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9769c181ecef69544bbb2f974b8c0e10.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9769c181ecef69544bbb2f974b8c0e10.exe

pid	process
1396	9769c181ecef69544bbb2f974b8c0e10.exe
1396	9769c181ecef69544bbb2f974b8c0e10.exe
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1260
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

9769c181ecef69544bbb2f974b8c0e10.exe

pid process

1396 9769c181ecef69544bbb2f974b8c0e10.exe

pid	process
1260

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

9769c181ecef69544bbb2f974b8c0e10.exe

description	pid	process	target process
PID 1356 wrote to memory of 1396	1356	9769c181ecef69544bbb2f974b8c0e10.exe	9769c181ecef69544bbb2f974b8c0e10.exe
PID 1356 wrote to memory of 1396	1356	9769c181ecef69544bbb2f974b8c0e10.exe	9769c181ecef69544bbb2f974b8c0e10.exe
PID 1356 wrote to memory of 1396	1356	9769c181ecef69544bbb2f974b8c0e10.exe	9769c181ecef69544bbb2f974b8c0e10.exe
PID 1356 wrote to memory of 1396	1356	9769c181ecef69544bbb2f974b8c0e10.exe	9769c181ecef69544bbb2f974b8c0e10.exe
PID 1356 wrote to memory of 1396	1356	9769c181ecef69544bbb2f974b8c0e10.exe	9769c181ecef69544bbb2f974b8c0e10.exe
PID 1356 wrote to memory of 1396	1356	9769c181ecef69544bbb2f974b8c0e10.exe	9769c181ecef69544bbb2f974b8c0e10.exe
PID 1356 wrote to memory of 1396	1356	9769c181ecef69544bbb2f974b8c0e10.exe	9769c181ecef69544bbb2f974b8c0e10.exe

C:\Users\Admin\AppData\Local\Temp\9769c181ecef69544bbb2f974b8c0e10.exe
"C:\Users\Admin\AppData\Local\Temp\9769c181ecef69544bbb2f974b8c0e10.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Users\Admin\AppData\Local\Temp\9769c181ecef69544bbb2f974b8c0e10.exe
  "C:\Users\Admin\AppData\Local\Temp\9769c181ecef69544bbb2f974b8c0e10.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-59-0x0000000002250000-0x0000000002266000-memory.dmp

Filesize
88KB

Download
memory/1260-64-0x000007FF63930000-0x000007FF6393A000-memory.dmp

Filesize
40KB

Download
memory/1356-54-0x0000000000220000-0x0000000000235000-memory.dmp

Filesize
84KB

Download
memory/1356-57-0x0000000000250000-0x0000000000259000-memory.dmp

Filesize
36KB

Download
memory/1396-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1396-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1396-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1396-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download