smokeloader | ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb

General

Target

9705b269886bfc7a262c12486f5e6802.exe
Size

181KB
MD5

9705b269886bfc7a262c12486f5e6802
SHA1

a9cb5931ddcc0cf8e5b886270bffdd14472e5248
SHA256

ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb
SHA512

5b23708a0f57a4e05533593f9fa9a85bc5f5201c98d6c6684151f33c764710f1988f7029af79e2c7bf45a1513495567e48f0d18b9efd534d84fdab9d1603cde6
SSDEEP

3072:OBfsGpcW25Gp+VIVnZqJQ1m9yGV0iT1gOcKFxq25KnB+WWxm78w2AAAvSFfG:SsGckEKnZU2GVBgWKB+hgv2A+G

Score

10^/10

smokeloader 6699 backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Botnet

6699

Extracted

Family

smokeloader

Version

2022

C2

http://atillapro.com/

https://atillapro.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1356
Executes dropped EXE 2 IoCs

Processes:

iifvbbfiifvbbf

pid process

2788 iifvbbf
2772 iifvbbf

pid	process
1356

pid	process
2788	iifvbbf
2772	iifvbbf

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9705b269886bfc7a262c12486f5e6802.exeiifvbbf

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows\CurrentVersion\Run\UnitySetup = "C:\\Users\\Public\\UnityStub.exe"	9705b269886bfc7a262c12486f5e6802.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows\CurrentVersion\Run\UnitySetup = "C:\\Users\\Public\\UnityStub.exe"	iifvbbf

Suspicious use of SetThreadContext 2 IoCs

Processes:

9705b269886bfc7a262c12486f5e6802.exeiifvbbf

description	pid	process	target process
PID 2340 set thread context of 2784	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2788 set thread context of 2772	2788	iifvbbf	iifvbbf

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9705b269886bfc7a262c12486f5e6802.exeiifvbbf

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9705b269886bfc7a262c12486f5e6802.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9705b269886bfc7a262c12486f5e6802.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9705b269886bfc7a262c12486f5e6802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	iifvbbf
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	iifvbbf
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	iifvbbf

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9705b269886bfc7a262c12486f5e6802.exe

pid	process
2784	9705b269886bfc7a262c12486f5e6802.exe
2784	9705b269886bfc7a262c12486f5e6802.exe
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1356

pid	process
1356

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

9705b269886bfc7a262c12486f5e6802.exe9705b269886bfc7a262c12486f5e6802.exeiifvbbfiifvbbf

pid	process
2340	9705b269886bfc7a262c12486f5e6802.exe
2340	9705b269886bfc7a262c12486f5e6802.exe
2340	9705b269886bfc7a262c12486f5e6802.exe
2784	9705b269886bfc7a262c12486f5e6802.exe
2788	iifvbbf
2772	iifvbbf

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

9705b269886bfc7a262c12486f5e6802.exetaskeng.exeiifvbbf

description	pid	process	target process
PID 2340 wrote to memory of 1952	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2340 wrote to memory of 1952	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2340 wrote to memory of 1952	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2340 wrote to memory of 1952	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2340 wrote to memory of 2792	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2340 wrote to memory of 2792	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2340 wrote to memory of 2792	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2340 wrote to memory of 2792	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2340 wrote to memory of 2784	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2340 wrote to memory of 2784	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2340 wrote to memory of 2784	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2340 wrote to memory of 2784	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 2340 wrote to memory of 2784	2340	9705b269886bfc7a262c12486f5e6802.exe	9705b269886bfc7a262c12486f5e6802.exe
PID 3056 wrote to memory of 2788	3056	taskeng.exe	iifvbbf
PID 3056 wrote to memory of 2788	3056	taskeng.exe	iifvbbf
PID 3056 wrote to memory of 2788	3056	taskeng.exe	iifvbbf
PID 3056 wrote to memory of 2788	3056	taskeng.exe	iifvbbf
PID 2788 wrote to memory of 2772	2788	iifvbbf	iifvbbf
PID 2788 wrote to memory of 2772	2788	iifvbbf	iifvbbf
PID 2788 wrote to memory of 2772	2788	iifvbbf	iifvbbf
PID 2788 wrote to memory of 2772	2788	iifvbbf	iifvbbf
PID 2788 wrote to memory of 2772	2788	iifvbbf	iifvbbf

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe
"C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2340

C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe
"C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe"
2⤵
PID:1952

C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe
"C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe"
2⤵
PID:2792

C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe
"C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2784

C:\Windows\system32\taskeng.exe
taskeng.exe {9944E07A-E200-403B-BD45-DDCF5A746CB6} S-1-5-21-2058106572-1146578376-825901627-1000:LPKQNNGV\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:3056

C:\Users\Admin\AppData\Roaming\iifvbbf
C:\Users\Admin\AppData\Roaming\iifvbbf
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2788

C:\Users\Admin\AppData\Roaming\iifvbbf
"C:\Users\Admin\AppData\Roaming\iifvbbf"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2772

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\iifvbbf
Filesize
181KB

MD5
9705b269886bfc7a262c12486f5e6802

SHA1
a9cb5931ddcc0cf8e5b886270bffdd14472e5248

SHA256
ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb

SHA512
5b23708a0f57a4e05533593f9fa9a85bc5f5201c98d6c6684151f33c764710f1988f7029af79e2c7bf45a1513495567e48f0d18b9efd534d84fdab9d1603cde6

Download Submit
C:\Users\Admin\AppData\Roaming\iifvbbf
Filesize
181KB

MD5
9705b269886bfc7a262c12486f5e6802

SHA1
a9cb5931ddcc0cf8e5b886270bffdd14472e5248

SHA256
ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb

SHA512
5b23708a0f57a4e05533593f9fa9a85bc5f5201c98d6c6684151f33c764710f1988f7029af79e2c7bf45a1513495567e48f0d18b9efd534d84fdab9d1603cde6

Download Submit
C:\Users\Admin\AppData\Roaming\iifvbbf
Filesize
181KB

MD5
9705b269886bfc7a262c12486f5e6802

SHA1
a9cb5931ddcc0cf8e5b886270bffdd14472e5248

SHA256
ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb

SHA512
5b23708a0f57a4e05533593f9fa9a85bc5f5201c98d6c6684151f33c764710f1988f7029af79e2c7bf45a1513495567e48f0d18b9efd534d84fdab9d1603cde6

Download Submit
C:\Users\Public\UnityStub.exe
Filesize
181KB

MD5
9705b269886bfc7a262c12486f5e6802

SHA1
a9cb5931ddcc0cf8e5b886270bffdd14472e5248

SHA256
ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb

SHA512
5b23708a0f57a4e05533593f9fa9a85bc5f5201c98d6c6684151f33c764710f1988f7029af79e2c7bf45a1513495567e48f0d18b9efd534d84fdab9d1603cde6

Download Submit
C:\Users\Public\UnityStub.exe
Filesize
181KB

MD5
9705b269886bfc7a262c12486f5e6802

SHA1
a9cb5931ddcc0cf8e5b886270bffdd14472e5248

SHA256
ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb

SHA512
5b23708a0f57a4e05533593f9fa9a85bc5f5201c98d6c6684151f33c764710f1988f7029af79e2c7bf45a1513495567e48f0d18b9efd534d84fdab9d1603cde6

Download Submit
memory/1356-6-0x0000000002540000-0x0000000002556000-memory.dmp

Filesize
88KB

Download
memory/1356-21-0x0000000002560000-0x0000000002576000-memory.dmp

Filesize
88KB

Download
memory/2340-1-0x0000000000130000-0x0000000000133000-memory.dmp

Filesize
12KB

Download
memory/2340-2-0x0000000000810000-0x000000000096C000-memory.dmp

Filesize
1.4MB

Download
memory/2772-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2784-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2784-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2784-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2788-17-0x0000000000790000-0x00000000008EC000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads