smokeloader | a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4

Analysis

max time kernel
300s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
29/10/2023, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe
Size

168KB
MD5

8b714a91eefb0adb29a056c121177505
SHA1

3db1b32f179bc63e44f72e0cc5b0b30ecc7e6163
SHA256

a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4
SHA512

4807cbf1a8b46be97804d864a27f5c8f27a98e6c678d662fcb2db22000c94d38a50a422625ae6eafa4e498e097b23cec9f418d1bf06368b13ece818d1effdfcd
SSDEEP

3072:AMwXQh5iR6Iiq4ooyGCezcHMUlzMjXnDW+8N0l0o3h0Nyb5KUR2U3:iQh5Y6Iiq4ooyczolkTWMKrNyDR3

Score

10^/10

smokeloader up3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Deletes itself 1 IoCs

pid	Process
1192	Process not Found

Executes dropped EXE 2 IoCs

pid	Process
2788	efatieb
2656	efatieb

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2564 set thread context of 2536	2564	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe	28
PID 2788 set thread context of 2656	2788	efatieb	33

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	efatieb
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	efatieb
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	efatieb
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2536	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe
2536	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found
1192	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2536	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe
2656	efatieb

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1192	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1192	Process not Found
1192	Process not Found

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1192	Process not Found
1192	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2536	2564	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe	28
PID 2564 wrote to memory of 2536	2564	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe	28
PID 2564 wrote to memory of 2536	2564	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe	28
PID 2564 wrote to memory of 2536	2564	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe	28
PID 2564 wrote to memory of 2536	2564	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe	28
PID 2564 wrote to memory of 2536	2564	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe	28
PID 2564 wrote to memory of 2536	2564	a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe	28
PID 2756 wrote to memory of 2788	2756	taskeng.exe	32
PID 2756 wrote to memory of 2788	2756	taskeng.exe	32
PID 2756 wrote to memory of 2788	2756	taskeng.exe	32
PID 2756 wrote to memory of 2788	2756	taskeng.exe	32
PID 2788 wrote to memory of 2656	2788	efatieb	33
PID 2788 wrote to memory of 2656	2788	efatieb	33
PID 2788 wrote to memory of 2656	2788	efatieb	33
PID 2788 wrote to memory of 2656	2788	efatieb	33
PID 2788 wrote to memory of 2656	2788	efatieb	33
PID 2788 wrote to memory of 2656	2788	efatieb	33
PID 2788 wrote to memory of 2656	2788	efatieb	33

C:\Users\Admin\AppData\Local\Temp\a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe
"C:\Users\Admin\AppData\Local\Temp\a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe
  "C:\Users\Admin\AppData\Local\Temp\a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2536

C:\Windows\system32\taskeng.exe
taskeng.exe {08C8930B-A3F3-43DF-ABAD-52886A6775F0} S-1-5-21-2952504676-3105837840-1406404655-1000:URUOZWGF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Roaming\efatieb
  C:\Users\Admin\AppData\Roaming\efatieb
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Users\Admin\AppData\Roaming\efatieb
    C:\Users\Admin\AppData\Roaming\efatieb
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\efatieb

Filesize
168KB

MD5
8b714a91eefb0adb29a056c121177505

SHA1
3db1b32f179bc63e44f72e0cc5b0b30ecc7e6163

SHA256
a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4

SHA512
4807cbf1a8b46be97804d864a27f5c8f27a98e6c678d662fcb2db22000c94d38a50a422625ae6eafa4e498e097b23cec9f418d1bf06368b13ece818d1effdfcd

Download Submit
C:\Users\Admin\AppData\Roaming\efatieb

Filesize
168KB

MD5
8b714a91eefb0adb29a056c121177505

SHA1
3db1b32f179bc63e44f72e0cc5b0b30ecc7e6163

SHA256
a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4

SHA512
4807cbf1a8b46be97804d864a27f5c8f27a98e6c678d662fcb2db22000c94d38a50a422625ae6eafa4e498e097b23cec9f418d1bf06368b13ece818d1effdfcd

Download Submit
C:\Users\Admin\AppData\Roaming\efatieb

Filesize
168KB

MD5
8b714a91eefb0adb29a056c121177505

SHA1
3db1b32f179bc63e44f72e0cc5b0b30ecc7e6163

SHA256
a213a1a513f4091c93057bf54a3e72c2426546bc0e89847935f05d45c4ff5de4

SHA512
4807cbf1a8b46be97804d864a27f5c8f27a98e6c678d662fcb2db22000c94d38a50a422625ae6eafa4e498e097b23cec9f418d1bf06368b13ece818d1effdfcd

Download Submit
memory/1192-8-0x00000000021B0000-0x00000000021C6000-memory.dmp

Filesize
88KB

Download
memory/1192-24-0x0000000002A40000-0x0000000002A56000-memory.dmp

Filesize
88KB

Download
memory/2536-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2536-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2536-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2536-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2536-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2564-1-0x00000000008B0000-0x00000000009B0000-memory.dmp

Filesize
1024KB

Download
memory/2564-2-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2656-25-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2788-23-0x0000000000830000-0x0000000000930000-memory.dmp

Filesize
1024KB

Download