smokeloader | 9caecc47d2e4e9758cd72483a679ccbc2ba4c6bc7966fa82eccbca74404a457c

Analysis

max time kernel
170s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

430KB
MD5

6a80d0a49a547e7634e6a3747d995ac8
SHA1

1729530fa0f1897ce2927d04e61ef3d34b509711
SHA256

9caecc47d2e4e9758cd72483a679ccbc2ba4c6bc7966fa82eccbca74404a457c
SHA512

33dc9cfc6ab171068a31782a5e9d855d227a0e42eeef364131cf8fc52e8e7af165babff004b8db269d055e0c435a15f4016a09b9332330b3bbf80ca441d0438f
SSDEEP

6144:Kny+bnr+9p0yN90QENZCuLS2EL02Nv//EOBRhwSSLuUl0SXmzbIvuvw1X767:9Mr1y90nYuO2P8bmSSLuMDuI767

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 2 IoCs

pid	Process
2600	v9695908.exe
2440	a7333758.exe

Loads dropped DLL 9 IoCs

pid	Process
2488	file.exe
2600	v9695908.exe
2600	v9695908.exe
2600	v9695908.exe
2440	a7333758.exe
2756	WerFault.exe
2756	WerFault.exe
2756	WerFault.exe
2756	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9695908.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 2624	2440	a7333758.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2440	WerFault.exe	28

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2624	AppLaunch.exe
2624	AppLaunch.exe
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found
1228	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1228	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2624	AppLaunch.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2600	2488	file.exe	27
PID 2488 wrote to memory of 2600	2488	file.exe	27
PID 2488 wrote to memory of 2600	2488	file.exe	27
PID 2488 wrote to memory of 2600	2488	file.exe	27
PID 2488 wrote to memory of 2600	2488	file.exe	27
PID 2488 wrote to memory of 2600	2488	file.exe	27
PID 2488 wrote to memory of 2600	2488	file.exe	27
PID 2600 wrote to memory of 2440	2600	v9695908.exe	28
PID 2600 wrote to memory of 2440	2600	v9695908.exe	28
PID 2600 wrote to memory of 2440	2600	v9695908.exe	28
PID 2600 wrote to memory of 2440	2600	v9695908.exe	28
PID 2600 wrote to memory of 2440	2600	v9695908.exe	28
PID 2600 wrote to memory of 2440	2600	v9695908.exe	28
PID 2600 wrote to memory of 2440	2600	v9695908.exe	28
PID 2440 wrote to memory of 2624	2440	a7333758.exe	30
PID 2440 wrote to memory of 2624	2440	a7333758.exe	30
PID 2440 wrote to memory of 2624	2440	a7333758.exe	30
PID 2440 wrote to memory of 2624	2440	a7333758.exe	30
PID 2440 wrote to memory of 2624	2440	a7333758.exe	30
PID 2440 wrote to memory of 2624	2440	a7333758.exe	30
PID 2440 wrote to memory of 2624	2440	a7333758.exe	30
PID 2440 wrote to memory of 2624	2440	a7333758.exe	30
PID 2440 wrote to memory of 2624	2440	a7333758.exe	30
PID 2440 wrote to memory of 2624	2440	a7333758.exe	30
PID 2440 wrote to memory of 2756	2440	a7333758.exe	31
PID 2440 wrote to memory of 2756	2440	a7333758.exe	31
PID 2440 wrote to memory of 2756	2440	a7333758.exe	31
PID 2440 wrote to memory of 2756	2440	a7333758.exe	31
PID 2440 wrote to memory of 2756	2440	a7333758.exe	31
PID 2440 wrote to memory of 2756	2440	a7333758.exe	31
PID 2440 wrote to memory of 2756	2440	a7333758.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9695908.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9695908.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7333758.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7333758.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 36
      4⤵
      Loads dropped DLL
      Program crash
      PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9695908.exe

Filesize
328KB

MD5
cb1af71ceead417172b28de58431ef66

SHA1
c5e0ec5d020a25deabc48084658e820977b0b4aa

SHA256
6ce79dba9cb413c17a6329782e03d458b45ba6c666c4bc0ea25ad987ad622109

SHA512
5e409b1d51efed7cfdc98a301f8b68e0cfb80fb8dbe80f306ac15d2af105198bfae17d54348be867224c39a9cbf99e1d0dfffffe69898f4f4589618c15251fd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9695908.exe

Filesize
328KB

MD5
cb1af71ceead417172b28de58431ef66

SHA1
c5e0ec5d020a25deabc48084658e820977b0b4aa

SHA256
6ce79dba9cb413c17a6329782e03d458b45ba6c666c4bc0ea25ad987ad622109

SHA512
5e409b1d51efed7cfdc98a301f8b68e0cfb80fb8dbe80f306ac15d2af105198bfae17d54348be867224c39a9cbf99e1d0dfffffe69898f4f4589618c15251fd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7333758.exe

Filesize
166KB

MD5
410af2f3e0bc3d247844509d7612fca0

SHA1
96bf45d02d6539dd6a575a3f517d4ebaa9f84343

SHA256
2356f822dafd186b6ff9a93ad828b9b5b72bf51e5e1f33d634b3570f09101cff

SHA512
b41be9ccab2469bdf8a732fee4b340438f0005bfef7117da858731790a062287603c6cbcad839e8a3b1e7d6c6a25d5f38fa79159030eae4927b16def344e977e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7333758.exe

Filesize
166KB

MD5
410af2f3e0bc3d247844509d7612fca0

SHA1
96bf45d02d6539dd6a575a3f517d4ebaa9f84343

SHA256
2356f822dafd186b6ff9a93ad828b9b5b72bf51e5e1f33d634b3570f09101cff

SHA512
b41be9ccab2469bdf8a732fee4b340438f0005bfef7117da858731790a062287603c6cbcad839e8a3b1e7d6c6a25d5f38fa79159030eae4927b16def344e977e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7333758.exe

Filesize
166KB

MD5
410af2f3e0bc3d247844509d7612fca0

SHA1
96bf45d02d6539dd6a575a3f517d4ebaa9f84343

SHA256
2356f822dafd186b6ff9a93ad828b9b5b72bf51e5e1f33d634b3570f09101cff

SHA512
b41be9ccab2469bdf8a732fee4b340438f0005bfef7117da858731790a062287603c6cbcad839e8a3b1e7d6c6a25d5f38fa79159030eae4927b16def344e977e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9695908.exe

Filesize
328KB

MD5
cb1af71ceead417172b28de58431ef66

SHA1
c5e0ec5d020a25deabc48084658e820977b0b4aa

SHA256
6ce79dba9cb413c17a6329782e03d458b45ba6c666c4bc0ea25ad987ad622109

SHA512
5e409b1d51efed7cfdc98a301f8b68e0cfb80fb8dbe80f306ac15d2af105198bfae17d54348be867224c39a9cbf99e1d0dfffffe69898f4f4589618c15251fd0

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9695908.exe

Filesize
328KB

MD5
cb1af71ceead417172b28de58431ef66

SHA1
c5e0ec5d020a25deabc48084658e820977b0b4aa

SHA256
6ce79dba9cb413c17a6329782e03d458b45ba6c666c4bc0ea25ad987ad622109

SHA512
5e409b1d51efed7cfdc98a301f8b68e0cfb80fb8dbe80f306ac15d2af105198bfae17d54348be867224c39a9cbf99e1d0dfffffe69898f4f4589618c15251fd0

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7333758.exe

Filesize
166KB

MD5
410af2f3e0bc3d247844509d7612fca0

SHA1
96bf45d02d6539dd6a575a3f517d4ebaa9f84343

SHA256
2356f822dafd186b6ff9a93ad828b9b5b72bf51e5e1f33d634b3570f09101cff

SHA512
b41be9ccab2469bdf8a732fee4b340438f0005bfef7117da858731790a062287603c6cbcad839e8a3b1e7d6c6a25d5f38fa79159030eae4927b16def344e977e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7333758.exe

Filesize
166KB

MD5
410af2f3e0bc3d247844509d7612fca0

SHA1
96bf45d02d6539dd6a575a3f517d4ebaa9f84343

SHA256
2356f822dafd186b6ff9a93ad828b9b5b72bf51e5e1f33d634b3570f09101cff

SHA512
b41be9ccab2469bdf8a732fee4b340438f0005bfef7117da858731790a062287603c6cbcad839e8a3b1e7d6c6a25d5f38fa79159030eae4927b16def344e977e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7333758.exe

Filesize
166KB

MD5
410af2f3e0bc3d247844509d7612fca0

SHA1
96bf45d02d6539dd6a575a3f517d4ebaa9f84343

SHA256
2356f822dafd186b6ff9a93ad828b9b5b72bf51e5e1f33d634b3570f09101cff

SHA512
b41be9ccab2469bdf8a732fee4b340438f0005bfef7117da858731790a062287603c6cbcad839e8a3b1e7d6c6a25d5f38fa79159030eae4927b16def344e977e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7333758.exe

Filesize
166KB

MD5
410af2f3e0bc3d247844509d7612fca0

SHA1
96bf45d02d6539dd6a575a3f517d4ebaa9f84343

SHA256
2356f822dafd186b6ff9a93ad828b9b5b72bf51e5e1f33d634b3570f09101cff

SHA512
b41be9ccab2469bdf8a732fee4b340438f0005bfef7117da858731790a062287603c6cbcad839e8a3b1e7d6c6a25d5f38fa79159030eae4927b16def344e977e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7333758.exe

Filesize
166KB

MD5
410af2f3e0bc3d247844509d7612fca0

SHA1
96bf45d02d6539dd6a575a3f517d4ebaa9f84343

SHA256
2356f822dafd186b6ff9a93ad828b9b5b72bf51e5e1f33d634b3570f09101cff

SHA512
b41be9ccab2469bdf8a732fee4b340438f0005bfef7117da858731790a062287603c6cbcad839e8a3b1e7d6c6a25d5f38fa79159030eae4927b16def344e977e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7333758.exe

Filesize
166KB

MD5
410af2f3e0bc3d247844509d7612fca0

SHA1
96bf45d02d6539dd6a575a3f517d4ebaa9f84343

SHA256
2356f822dafd186b6ff9a93ad828b9b5b72bf51e5e1f33d634b3570f09101cff

SHA512
b41be9ccab2469bdf8a732fee4b340438f0005bfef7117da858731790a062287603c6cbcad839e8a3b1e7d6c6a25d5f38fa79159030eae4927b16def344e977e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7333758.exe

Filesize
166KB

MD5
410af2f3e0bc3d247844509d7612fca0

SHA1
96bf45d02d6539dd6a575a3f517d4ebaa9f84343

SHA256
2356f822dafd186b6ff9a93ad828b9b5b72bf51e5e1f33d634b3570f09101cff

SHA512
b41be9ccab2469bdf8a732fee4b340438f0005bfef7117da858731790a062287603c6cbcad839e8a3b1e7d6c6a25d5f38fa79159030eae4927b16def344e977e

Download Submit
memory/1228-32-0x0000000002C80000-0x0000000002C96000-memory.dmp

Filesize
88KB

Download
memory/2624-23-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2624-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2624-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2624-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2624-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2624-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download