smokeloader | cf1fac50d3a4dbed048835a95e6fe15fffbe845acf21db47b7434b16440c7939

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-12-2023 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

288KB
MD5

eb9fabeb360a4822f746ba78a2a149d3
SHA1

6f5578468b62a442b601d16316df182a3524bba4
SHA256

cf1fac50d3a4dbed048835a95e6fe15fffbe845acf21db47b7434b16440c7939
SHA512

69759c7f63404d443e9f880a34ff2575166cb16224d207c3cbfd86b0d235abe466b1e4c8dc9a406efb8938bbcca0dfa0cba0c3fff385c7e9d528d88303c57d61
SSDEEP

3072:SheToEwteZB7aE9yHp21T+VWqLrU35VvCsyKgHRaW8ZapPwOeTsWL:Y6Etermp2wWq/U35VvmKNHMpoT

Score

10^/10

smokeloader pub4 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

http://humydrole.com/tmp/index.php

http://trunk-co.ru/tmp/index.php

http://weareelight.com/tmp/index.php

http://pirateking.online/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1240
Executes dropped EXE 1 IoCs

Processes:

aeasves

pid process

2868 aeasves

pid	process
1240

pid	process
2868	aeasves

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

file.exeaeasves

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aeasves
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aeasves
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aeasves

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exe

pid	process
2296	file.exe
2296	file.exe
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

file.exeaeasves

pid process

2296 file.exe
2868 aeasves

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1492 wrote to memory of 2868	1492	taskeng.exe	aeasves
PID 1492 wrote to memory of 2868	1492	taskeng.exe	aeasves
PID 1492 wrote to memory of 2868	1492	taskeng.exe	aeasves
PID 1492 wrote to memory of 2868	1492	taskeng.exe	aeasves

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2296

C:\Windows\system32\taskeng.exe
taskeng.exe {C0A01D01-9FCD-4FB1-8DCF-0F07220AC2C1} S-1-5-21-3618187007-3650799920-3290345941-1000:BPDFUYWR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\AppData\Roaming\aeasves
C:\Users\Admin\AppData\Roaming\aeasves
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\aeasves

Filesize
288KB

MD5
eb9fabeb360a4822f746ba78a2a149d3

SHA1
6f5578468b62a442b601d16316df182a3524bba4

SHA256
cf1fac50d3a4dbed048835a95e6fe15fffbe845acf21db47b7434b16440c7939

SHA512
69759c7f63404d443e9f880a34ff2575166cb16224d207c3cbfd86b0d235abe466b1e4c8dc9a406efb8938bbcca0dfa0cba0c3fff385c7e9d528d88303c57d61

Download Submit
C:\Users\Admin\AppData\Roaming\aeasves

Filesize
288KB

MD5
eb9fabeb360a4822f746ba78a2a149d3

SHA1
6f5578468b62a442b601d16316df182a3524bba4

SHA256
cf1fac50d3a4dbed048835a95e6fe15fffbe845acf21db47b7434b16440c7939

SHA512
69759c7f63404d443e9f880a34ff2575166cb16224d207c3cbfd86b0d235abe466b1e4c8dc9a406efb8938bbcca0dfa0cba0c3fff385c7e9d528d88303c57d61

Download Submit
memory/1240-4-0x0000000002A80000-0x0000000002A96000-memory.dmp

Filesize
88KB

Download
memory/1240-16-0x0000000002C50000-0x0000000002C66000-memory.dmp

Filesize
88KB

Download
memory/2296-1-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download
memory/2296-2-0x00000000001B0000-0x00000000001BB000-memory.dmp

Filesize
44KB

Download
memory/2296-3-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2296-5-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2868-14-0x0000000000930000-0x0000000000A30000-memory.dmp

Filesize
1024KB

Download
memory/2868-15-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2868-17-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download