smokeloader | 17c7cc079465da191a8ed1512b8088b869415f5bc5bccf3eb72b0820b7f35619

General

Target

WEXTRACT.exe
Size

427KB
MD5

be982f88b4dc59376512980069e223e6
SHA1

0e410efd5f98f96ae5cea91ea60a827db48bdb11
SHA256

17c7cc079465da191a8ed1512b8088b869415f5bc5bccf3eb72b0820b7f35619
SHA512

b763f0235689765d1aceefc76925cc6b714630e1760b6e221b378263e9019e18f5f2002bcbb242ce1016efbc0ff79d7645c3025e7b7a6f27daba02552377a197
SSDEEP

6144:K2y+bnr+Bp0yN90QEF6VvTOaAJL63hsjz+7Ha3th4oIrfwXxp3DMgZtyXs2bBub9:+MrZy90KdIJLUxstfWfwXxpzMg+RQ9

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 3 IoCs

Processes:

v0143080.exea8638369.exearvhcua

pid process

1904 v0143080.exe
2156 a8638369.exe
1724 arvhcua

pid	process
1904	v0143080.exe
2156	a8638369.exe
1724	arvhcua

Loads dropped DLL 9 IoCs

Processes:

WEXTRACT.exev0143080.exea8638369.exeWerFault.exe

pid	process
1928	WEXTRACT.exe
1904	v0143080.exe
1904	v0143080.exe
1904	v0143080.exe
2156	a8638369.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WEXTRACT.exev0143080.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	WEXTRACT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0143080.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a8638369.exe

description pid process target process

PID 2156 set thread context of 2836 2156 a8638369.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

2952 2156 WerFault.exe

description	pid	process	target process
PID 2156 set thread context of 2836	2156	a8638369.exe	AppLaunch.exe

pid	pid_target	process
2952	2156	WerFault.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exe

pid	process
2836	AppLaunch.exe
2836	AppLaunch.exe
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

AppLaunch.exe

pid process

2836 AppLaunch.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

WEXTRACT.exev0143080.exea8638369.exetaskeng.exe

description	pid	process	target process
PID 1928 wrote to memory of 1904	1928	WEXTRACT.exe	v0143080.exe
PID 1928 wrote to memory of 1904	1928	WEXTRACT.exe	v0143080.exe
PID 1928 wrote to memory of 1904	1928	WEXTRACT.exe	v0143080.exe
PID 1928 wrote to memory of 1904	1928	WEXTRACT.exe	v0143080.exe
PID 1928 wrote to memory of 1904	1928	WEXTRACT.exe	v0143080.exe
PID 1928 wrote to memory of 1904	1928	WEXTRACT.exe	v0143080.exe
PID 1928 wrote to memory of 1904	1928	WEXTRACT.exe	v0143080.exe
PID 1904 wrote to memory of 2156	1904	v0143080.exe	a8638369.exe
PID 1904 wrote to memory of 2156	1904	v0143080.exe	a8638369.exe
PID 1904 wrote to memory of 2156	1904	v0143080.exe	a8638369.exe
PID 1904 wrote to memory of 2156	1904	v0143080.exe	a8638369.exe
PID 1904 wrote to memory of 2156	1904	v0143080.exe	a8638369.exe
PID 1904 wrote to memory of 2156	1904	v0143080.exe	a8638369.exe
PID 1904 wrote to memory of 2156	1904	v0143080.exe	a8638369.exe
PID 2156 wrote to memory of 2836	2156	a8638369.exe	AppLaunch.exe
PID 2156 wrote to memory of 2836	2156	a8638369.exe	AppLaunch.exe
PID 2156 wrote to memory of 2836	2156	a8638369.exe	AppLaunch.exe
PID 2156 wrote to memory of 2836	2156	a8638369.exe	AppLaunch.exe
PID 2156 wrote to memory of 2836	2156	a8638369.exe	AppLaunch.exe
PID 2156 wrote to memory of 2836	2156	a8638369.exe	AppLaunch.exe
PID 2156 wrote to memory of 2836	2156	a8638369.exe	AppLaunch.exe
PID 2156 wrote to memory of 2836	2156	a8638369.exe	AppLaunch.exe
PID 2156 wrote to memory of 2836	2156	a8638369.exe	AppLaunch.exe
PID 2156 wrote to memory of 2836	2156	a8638369.exe	AppLaunch.exe
PID 2156 wrote to memory of 2952	2156	a8638369.exe	WerFault.exe
PID 2156 wrote to memory of 2952	2156	a8638369.exe	WerFault.exe
PID 2156 wrote to memory of 2952	2156	a8638369.exe	WerFault.exe
PID 2156 wrote to memory of 2952	2156	a8638369.exe	WerFault.exe
PID 2156 wrote to memory of 2952	2156	a8638369.exe	WerFault.exe
PID 2156 wrote to memory of 2952	2156	a8638369.exe	WerFault.exe
PID 2156 wrote to memory of 2952	2156	a8638369.exe	WerFault.exe
PID 2140 wrote to memory of 1724	2140	taskeng.exe	arvhcua
PID 2140 wrote to memory of 1724	2140	taskeng.exe	arvhcua
PID 2140 wrote to memory of 1724	2140	taskeng.exe	arvhcua
PID 2140 wrote to memory of 1724	2140	taskeng.exe	arvhcua

C:\Users\Admin\AppData\Local\Temp\WEXTRACT.exe
"C:\Users\Admin\AppData\Local\Temp\WEXTRACT.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1928

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0143080.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0143080.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8638369.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8638369.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 36
1⤵
- Loads dropped DLL
- Program crash
PID:2952

C:\Windows\system32\taskeng.exe
taskeng.exe {42FD4E48-BA97-4B32-9EF9-34EE87F79D77} S-1-5-21-3601492379-692465709-652514833-1000:CALKHSYM\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Users\Admin\AppData\Roaming\arvhcua
C:\Users\Admin\AppData\Roaming\arvhcua
2⤵
- Executes dropped EXE
PID:1724

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0143080.exe
Filesize
325KB

MD5
6d3e807bc5b1075951cb02aee1040ce4

SHA1
e46b8731eb240af658cd92f869b9c4c48255d572

SHA256
3044994d68ed802e317cd4395ed588a0928dd006e4359ff907691fdcfd3b45f7

SHA512
b2bccf1135ef7a8d0adfeaa158933e730206e0cbf3920ffab0a8aad0eda01d6c14ac176bf0215bcb0e77385b6f5562fb1ddb7e87a8acb8cfdb3290dd1800ea2f

Download Submit
C:\Users\Admin\AppData\Roaming\arvhcua
Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0143080.exe
Filesize
256KB

MD5
8f5a5b30d9da4f77d1d5ebf8deafa506

SHA1
51bbe9d2a8a78cc7ceb2450e275cc7ea429ec1b3

SHA256
a4006371f134ff2533cb4ae993e903894feb6595df66b66737c9ad8883567c4e

SHA512
40b10e049632d4e262e7e0e46df8f4cf6d922305fbbdcb696b90278a38bc1ced9ebeba90fcaab79883494447401bed7f791f71417ec195ea9d3d257f48b4b866

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8638369.exe
Filesize
166KB

MD5
6b3b5578bfce84e4564382d8dcb84c88

SHA1
fbe695d073f9bf1c4480f0da2e75de798d58deba

SHA256
48eab4277fff7669eb09844dd2d5de7a5edc2a487a6a4ef9b540785fff1bc9c1

SHA512
c4b48b40fdb6ebdbfd4cd6c42a4ce34c8a5d4e74163eda9cb197e7bad1a2d2bb80653b1ecb47dbb4ad106e1570663945de22301623aceef70c802354091957f8

Download Submit
memory/1144-32-0x0000000002F00000-0x0000000002F16000-memory.dmp

Filesize
88KB

Download
memory/2836-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2836-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2836-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2836-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2836-23-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2836-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads