smokeloader | 7319656b4c5c0f3c42526657e96c0732322806d7824e992baa4b816a525aae98

Analysis

max time kernel
44s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2023 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Botnets PACK/Botnets PACK/Smoke Loader Original Stub/nssdbm3/CoreShell.exe
Size

13KB
MD5

75f6bb5d297c4ffbdff65cc5bbbdfb37
SHA1

0aa7c2e75f63c685d8d085fbafca3a91d297b683
SHA256

5eb4e7d954ad12e89c9c500f9894b76d08b7e53eb0f3f0b0e681d3bf11c4db51
SHA512

fdb38133304714e3e553b02df7a7bb62b9127c9c832390ffb1553f3523cdffd00611b29a4916f00bd6b79209fef5b0ca4e4c28192e5522880bbde231c00ca7df
SSDEEP

192:vBAlEMZWAY5nCtCY61l40CMvPSohzWLz5xWfgOQ/muu/d5THm4OtgO:JAnLAXNy/m3/bTKgO

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2017

http://dogewareservice.ru/

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	CoreShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	CoreShell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe
548	CoreShell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
548	CoreShell.exe
548	CoreShell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 348	548	CoreShell.exe	83
PID 548 wrote to memory of 348	548	CoreShell.exe	83
PID 548 wrote to memory of 348	548	CoreShell.exe	83

C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\Smoke Loader Original Stub\nssdbm3\CoreShell.exe
"C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\Smoke Loader Original Stub\nssdbm3\CoreShell.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/348-141-0x00000000005F0000-0x0000000000A23000-memory.dmp

Filesize
4.2MB

Download
memory/348-143-0x00000000005F0000-0x0000000000A23000-memory.dmp

Filesize
4.2MB

Download
memory/348-144-0x0000000000E90000-0x0000000000E9A000-memory.dmp

Filesize
40KB

Download
memory/348-146-0x0000000000E90000-0x0000000000E9A000-memory.dmp

Filesize
40KB

Download
memory/548-136-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/548-137-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/548-138-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/548-140-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/548-148-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/548-150-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download