smokeloader | db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211

Analysis

max time kernel
300s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22-08-2023 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe
Size

248KB
MD5

0463b8abe1f537979c3124ea6d948164
SHA1

a16b47f1e3986173df3f5a57ce8eb8a16a50903e
SHA256

db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211
SHA512

fbf4394335447bc9f524356ceab7a8d5b35f3b89537093e552ffe83647aefe4a7f4299dea5e38ca57a0ef1e11125af84ab2fc713173e720b791b84de534192bd
SSDEEP

3072:qeYZCLSWRH37DR+Cs7QxxcayGQFW4lb7TtGQ5L1lFTXeM5XpQEtF:YZCL9H37fs7QAzNFrbnMWL1lFTXpX

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Deletes itself 1 IoCs

pid	Process
1208	Process not Found

Executes dropped EXE 2 IoCs

pid	Process
2812	sgbwrct
2036	sgbwrct

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1860 set thread context of 2608	1860	db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe	28
PID 2812 set thread context of 2036	2812	sgbwrct	33

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2608	db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe
2608	db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1208	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2608	db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe
2036	sgbwrct

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1208	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2608	1860	db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe	28
PID 1860 wrote to memory of 2608	1860	db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe	28
PID 1860 wrote to memory of 2608	1860	db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe	28
PID 1860 wrote to memory of 2608	1860	db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe	28
PID 1860 wrote to memory of 2608	1860	db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe	28
PID 1860 wrote to memory of 2608	1860	db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe	28
PID 1860 wrote to memory of 2608	1860	db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe	28
PID 2644 wrote to memory of 2812	2644	taskeng.exe	32
PID 2644 wrote to memory of 2812	2644	taskeng.exe	32
PID 2644 wrote to memory of 2812	2644	taskeng.exe	32
PID 2644 wrote to memory of 2812	2644	taskeng.exe	32
PID 2812 wrote to memory of 2036	2812	sgbwrct	33
PID 2812 wrote to memory of 2036	2812	sgbwrct	33
PID 2812 wrote to memory of 2036	2812	sgbwrct	33
PID 2812 wrote to memory of 2036	2812	sgbwrct	33
PID 2812 wrote to memory of 2036	2812	sgbwrct	33
PID 2812 wrote to memory of 2036	2812	sgbwrct	33
PID 2812 wrote to memory of 2036	2812	sgbwrct	33

C:\Users\Admin\AppData\Local\Temp\db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe
"C:\Users\Admin\AppData\Local\Temp\db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe
  "C:\Users\Admin\AppData\Local\Temp\db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2608

C:\Windows\system32\taskeng.exe
taskeng.exe {FA161D53-F0DF-47A9-8AA6-E3D63816CD2B} S-1-5-21-377084978-2088738870-2818360375-1000:DSWJWADP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Roaming\sgbwrct
  C:\Users\Admin\AppData\Roaming\sgbwrct
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Users\Admin\AppData\Roaming\sgbwrct
    C:\Users\Admin\AppData\Roaming\sgbwrct
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: MapViewOfSection
    PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\sgbwrct

Filesize
248KB

MD5
0463b8abe1f537979c3124ea6d948164

SHA1
a16b47f1e3986173df3f5a57ce8eb8a16a50903e

SHA256
db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211

SHA512
fbf4394335447bc9f524356ceab7a8d5b35f3b89537093e552ffe83647aefe4a7f4299dea5e38ca57a0ef1e11125af84ab2fc713173e720b791b84de534192bd

Download Submit
C:\Users\Admin\AppData\Roaming\sgbwrct

Filesize
248KB

MD5
0463b8abe1f537979c3124ea6d948164

SHA1
a16b47f1e3986173df3f5a57ce8eb8a16a50903e

SHA256
db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211

SHA512
fbf4394335447bc9f524356ceab7a8d5b35f3b89537093e552ffe83647aefe4a7f4299dea5e38ca57a0ef1e11125af84ab2fc713173e720b791b84de534192bd

Download Submit
C:\Users\Admin\AppData\Roaming\sgbwrct

Filesize
248KB

MD5
0463b8abe1f537979c3124ea6d948164

SHA1
a16b47f1e3986173df3f5a57ce8eb8a16a50903e

SHA256
db7882a8a9fad086f7b4d9ff145fd9133790e01ff39c4de5493437a43fc5b211

SHA512
fbf4394335447bc9f524356ceab7a8d5b35f3b89537093e552ffe83647aefe4a7f4299dea5e38ca57a0ef1e11125af84ab2fc713173e720b791b84de534192bd

Download Submit
memory/1208-75-0x00000000029E0000-0x00000000029F6000-memory.dmp

Filesize
88KB

Download
memory/1208-60-0x0000000002950000-0x0000000002966000-memory.dmp

Filesize
88KB

Download
memory/1860-53-0x0000000000220000-0x0000000000235000-memory.dmp

Filesize
84KB

Download
memory/1860-54-0x0000000000240000-0x0000000000249000-memory.dmp

Filesize
36KB

Download
memory/1860-58-0x0000000000220000-0x0000000000235000-memory.dmp

Filesize
84KB

Download
memory/2036-76-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2036-74-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2608-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2608-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2608-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2608-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download