smokeloader | 931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a

Analysis

max time kernel
300s
max time network
128s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21/08/2023, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe
Size

216KB
MD5

30d35fdeffca7c09516a4dc81b28bd2a
SHA1

f9214fed0e0ff84289418fb1df55f2ccdd7b3373
SHA256

931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a
SHA512

770fcd37fa937dcadc93808fb4419591941b68e5097e044fb207a8da9822ad3cc534c680998b625d3ce3166b9edb6890d16d966dcf20fb299ab371889a7e0370
SSDEEP

3072:4DaaPugLWW94WKnIzjjpeM8PIiKRydNtjr+Ac:zgLv4tIHjpeM8uEjr+

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Deletes itself 1 IoCs

pid	Process
1268	Process not Found

Executes dropped EXE 2 IoCs

pid	Process
2344	sfftjcw
2160	sfftjcw

Loads dropped DLL 1 IoCs

pid	Process
2344	sfftjcw

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1524 set thread context of 2012	1524	931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe	28
PID 2344 set thread context of 2160	2344	sfftjcw	33

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2012	931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe
2012	931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found
1268	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1268	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2012	931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe
2160	sfftjcw

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1268	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2012	1524	931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe	28
PID 1524 wrote to memory of 2012	1524	931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe	28
PID 1524 wrote to memory of 2012	1524	931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe	28
PID 1524 wrote to memory of 2012	1524	931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe	28
PID 1524 wrote to memory of 2012	1524	931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe	28
PID 1524 wrote to memory of 2012	1524	931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe	28
PID 1524 wrote to memory of 2012	1524	931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe	28
PID 2836 wrote to memory of 2344	2836	taskeng.exe	32
PID 2836 wrote to memory of 2344	2836	taskeng.exe	32
PID 2836 wrote to memory of 2344	2836	taskeng.exe	32
PID 2836 wrote to memory of 2344	2836	taskeng.exe	32
PID 2344 wrote to memory of 2160	2344	sfftjcw	33
PID 2344 wrote to memory of 2160	2344	sfftjcw	33
PID 2344 wrote to memory of 2160	2344	sfftjcw	33
PID 2344 wrote to memory of 2160	2344	sfftjcw	33
PID 2344 wrote to memory of 2160	2344	sfftjcw	33
PID 2344 wrote to memory of 2160	2344	sfftjcw	33
PID 2344 wrote to memory of 2160	2344	sfftjcw	33

C:\Users\Admin\AppData\Local\Temp\931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe
"C:\Users\Admin\AppData\Local\Temp\931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe
  "C:\Users\Admin\AppData\Local\Temp\931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2012

C:\Windows\system32\taskeng.exe
taskeng.exe {0DB16CDD-5149-44F0-8F3E-CCF0A2850D7C} S-1-5-21-2969888527-3102471180-2307688834-1000:YKQDESCX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Roaming\sfftjcw
  C:\Users\Admin\AppData\Roaming\sfftjcw
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Users\Admin\AppData\Roaming\sfftjcw
    C:\Users\Admin\AppData\Roaming\sfftjcw
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: MapViewOfSection
    PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\sfftjcw

Filesize
216KB

MD5
30d35fdeffca7c09516a4dc81b28bd2a

SHA1
f9214fed0e0ff84289418fb1df55f2ccdd7b3373

SHA256
931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a

SHA512
770fcd37fa937dcadc93808fb4419591941b68e5097e044fb207a8da9822ad3cc534c680998b625d3ce3166b9edb6890d16d966dcf20fb299ab371889a7e0370

Download Submit
C:\Users\Admin\AppData\Roaming\sfftjcw

Filesize
216KB

MD5
30d35fdeffca7c09516a4dc81b28bd2a

SHA1
f9214fed0e0ff84289418fb1df55f2ccdd7b3373

SHA256
931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a

SHA512
770fcd37fa937dcadc93808fb4419591941b68e5097e044fb207a8da9822ad3cc534c680998b625d3ce3166b9edb6890d16d966dcf20fb299ab371889a7e0370

Download Submit
C:\Users\Admin\AppData\Roaming\sfftjcw

Filesize
216KB

MD5
30d35fdeffca7c09516a4dc81b28bd2a

SHA1
f9214fed0e0ff84289418fb1df55f2ccdd7b3373

SHA256
931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a

SHA512
770fcd37fa937dcadc93808fb4419591941b68e5097e044fb207a8da9822ad3cc534c680998b625d3ce3166b9edb6890d16d966dcf20fb299ab371889a7e0370

Download Submit
\Users\Admin\AppData\Roaming\sfftjcw

Filesize
216KB

MD5
30d35fdeffca7c09516a4dc81b28bd2a

SHA1
f9214fed0e0ff84289418fb1df55f2ccdd7b3373

SHA256
931d05ea59f0f22fedce87afe0e53b7c81e72d4375d8273f78199509eb47872a

SHA512
770fcd37fa937dcadc93808fb4419591941b68e5097e044fb207a8da9822ad3cc534c680998b625d3ce3166b9edb6890d16d966dcf20fb299ab371889a7e0370

Download Submit
memory/1268-60-0x0000000002B60000-0x0000000002B76000-memory.dmp

Filesize
88KB

Download
memory/1268-76-0x0000000002C00000-0x0000000002C16000-memory.dmp

Filesize
88KB

Download
memory/1524-53-0x0000000000230000-0x0000000000245000-memory.dmp

Filesize
84KB

Download
memory/1524-58-0x0000000000230000-0x0000000000245000-memory.dmp

Filesize
84KB

Download
memory/1524-55-0x0000000000250000-0x0000000000259000-memory.dmp

Filesize
36KB

Download
memory/2012-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2012-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2012-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2012-54-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2160-75-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2160-77-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download