smokeloader | deb7a8abd9a724fa0d653ceebcbff77f8c8d68410065073d9f59e9f1db26f64c

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5273b5cf689eb112bed01b8924158cb2.exe
Size

273KB
MD5

5273b5cf689eb112bed01b8924158cb2
SHA1

5c9efe5d65b9b2311ddeefea89378bd6244110ca
SHA256

deb7a8abd9a724fa0d653ceebcbff77f8c8d68410065073d9f59e9f1db26f64c
SHA512

17c5101e399c8cd4300c77cdcb7164e4e28589d11b301bbbaf74d4987b420fe37248f178f2175ebfd0e709761ebb04351b9a1ec3048ee4e231f5ee62bdb8e94f
SSDEEP

6144:bUCkNHFDgJBlHzDa79syPFv5Ae6GTev+AdKI:algJBlfaeyPFhJ/TvAdT

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://readinglistforaugust1.xyz/

http://readinglistforaugust2.xyz/

http://readinglistforaugust3.xyz/

http://readinglistforaugust4.xyz/

http://readinglistforaugust5.xyz/

http://readinglistforaugust6.xyz/

http://readinglistforaugust7.xyz/

http://readinglistforaugust8.xyz/

http://readinglistforaugust9.xyz/

http://readinglistforaugust10.xyz/

http://readinglistforaugust1.site/

http://readinglistforaugust2.site/

http://readinglistforaugust3.site/

http://readinglistforaugust4.site/

http://readinglistforaugust5.site/

http://readinglistforaugust6.site/

http://readinglistforaugust7.site/

http://readinglistforaugust8.site/

http://readinglistforaugust9.site/

http://readinglistforaugust10.site/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Deletes itself 1 IoCs

pid	Process
1244	Process not Found

Executes dropped EXE 2 IoCs

pid	Process
2928	fhivwej
2948	fhivwej

Loads dropped DLL 1 IoCs

pid	Process
2928	fhivwej

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 368 set thread context of 2172	368	5273b5cf689eb112bed01b8924158cb2.exe	28
PID 2928 set thread context of 2948	2928	fhivwej	33

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fhivwej
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fhivwej
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fhivwej
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5273b5cf689eb112bed01b8924158cb2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5273b5cf689eb112bed01b8924158cb2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5273b5cf689eb112bed01b8924158cb2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2172	5273b5cf689eb112bed01b8924158cb2.exe
2172	5273b5cf689eb112bed01b8924158cb2.exe
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2172	5273b5cf689eb112bed01b8924158cb2.exe
2948	fhivwej

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 2172	368	5273b5cf689eb112bed01b8924158cb2.exe	28
PID 368 wrote to memory of 2172	368	5273b5cf689eb112bed01b8924158cb2.exe	28
PID 368 wrote to memory of 2172	368	5273b5cf689eb112bed01b8924158cb2.exe	28
PID 368 wrote to memory of 2172	368	5273b5cf689eb112bed01b8924158cb2.exe	28
PID 368 wrote to memory of 2172	368	5273b5cf689eb112bed01b8924158cb2.exe	28
PID 368 wrote to memory of 2172	368	5273b5cf689eb112bed01b8924158cb2.exe	28
PID 368 wrote to memory of 2172	368	5273b5cf689eb112bed01b8924158cb2.exe	28
PID 2900 wrote to memory of 2928	2900	taskeng.exe	32
PID 2900 wrote to memory of 2928	2900	taskeng.exe	32
PID 2900 wrote to memory of 2928	2900	taskeng.exe	32
PID 2900 wrote to memory of 2928	2900	taskeng.exe	32
PID 2928 wrote to memory of 2948	2928	fhivwej	33
PID 2928 wrote to memory of 2948	2928	fhivwej	33
PID 2928 wrote to memory of 2948	2928	fhivwej	33
PID 2928 wrote to memory of 2948	2928	fhivwej	33
PID 2928 wrote to memory of 2948	2928	fhivwej	33
PID 2928 wrote to memory of 2948	2928	fhivwej	33
PID 2928 wrote to memory of 2948	2928	fhivwej	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5273b5cf689eb112bed01b8924158cb2.exe
"C:\Users\Admin\AppData\Local\Temp\5273b5cf689eb112bed01b8924158cb2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Local\Temp\5273b5cf689eb112bed01b8924158cb2.exe
  "C:\Users\Admin\AppData\Local\Temp\5273b5cf689eb112bed01b8924158cb2.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2172

C:\Windows\system32\taskeng.exe
taskeng.exe {1F7D9D32-7CA8-4DD6-8D39-6A263E8AB21D} S-1-5-21-2444714103-3190537498-3629098939-1000:DJLAPDMX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Roaming\fhivwej
  C:\Users\Admin\AppData\Roaming\fhivwej
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Users\Admin\AppData\Roaming\fhivwej
    C:\Users\Admin\AppData\Roaming\fhivwej
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\fhivwej

Filesize
207KB

MD5
2512f7a2c34fbfe814994173227bced2

SHA1
dfa1c88a76a2581f4e9e2343e4b4afc60b3d7203

SHA256
5a8c4264d4547a4eec39173433e8ba542fa61abb532b4397c986121424c2c5d0

SHA512
af1b5226f069526ac1e2056d41c7332891529a70fe9cb55cf698b56279c17152759910c9a11cafa842a80f9911cb18db418e0be002dcc3174bbc280a604c23b3

Download Submit
C:\Users\Admin\AppData\Roaming\fhivwej

Filesize
166KB

MD5
bf64a9c03bddfce84425194e96d194c3

SHA1
8e126ace6b4d86e8ac4496d74708758616bf6ee3

SHA256
838f067dfbfa7d554de7d90c67155a56f96f60bbf88ceb36d80721ae3dcb7a61

SHA512
a4121cf50edd0479b4a67045624ae4809ebde9d4f1a362682761b80efab256dcd8866af42db3c45ac9273a77a9c75c75c9d8900691cd7a3e47c51d6cf2705f7b

Download Submit
\Users\Admin\AppData\Roaming\fhivwej

Filesize
273KB

MD5
5273b5cf689eb112bed01b8924158cb2

SHA1
5c9efe5d65b9b2311ddeefea89378bd6244110ca

SHA256
deb7a8abd9a724fa0d653ceebcbff77f8c8d68410065073d9f59e9f1db26f64c

SHA512
17c5101e399c8cd4300c77cdcb7164e4e28589d11b301bbbaf74d4987b420fe37248f178f2175ebfd0e709761ebb04351b9a1ec3048ee4e231f5ee62bdb8e94f

Download Submit
memory/368-3-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/368-1-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1244-8-0x0000000002A10000-0x0000000002A26000-memory.dmp

Filesize
88KB

Download
memory/1244-26-0x0000000002A40000-0x0000000002A56000-memory.dmp

Filesize
88KB

Download
memory/2172-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2172-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2172-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2172-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2172-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2928-21-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/2948-25-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2948-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download