smokeloader | ef743dcfbc3b85460416d9708cd43452354c148b375ef94075aaa79207c6467b

Analysis

max time kernel
150s
max time network
144s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
14-01-2024 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

toolspab2.exe
Size

207KB
MD5

38cb64fa3339058ae21850bb66b82279
SHA1

4ab731f54aec2b9a8c49bf5e38fe294e9745b604
SHA256

ef743dcfbc3b85460416d9708cd43452354c148b375ef94075aaa79207c6467b
SHA512

23ac1bfc8e21b879d347867e7a66af3a2b907265ce8fe415e6315ba7e1b9631c9c32d14b51e95e226661c1630f43d2d0e10e5d17705b9b6fe3200a3a1c13b3a7
SSDEEP

3072:JXNxFFqcLXdCOck2DLO5LE99KsIv3UVmi2nRpMqC3L4EkwAD:t3bqcLtL2LMMPa3UVxIyqCb41p

Score

10^/10

smokeloader pub2 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

3276
Executes dropped EXE 5 IoCs

Processes:

FA3E.exe106.exeWindowsUpdater.exeuabgggsuabgggs

pid process

4344 FA3E.exe
1636 106.exe
3048 WindowsUpdater.exe
4044 uabgggs
4904 uabgggs
Loads dropped DLL 2 IoCs

Processes:

WindowsUpdater.exe

pid process

3048 WindowsUpdater.exe
3048 WindowsUpdater.exe

pid	process
3276

pid	process
4344	FA3E.exe
1636	106.exe
3048	WindowsUpdater.exe
4044	uabgggs
4904	uabgggs

pid	process
3048	WindowsUpdater.exe
3048	WindowsUpdater.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

toolspab2.exeuabgggs

description	pid	process	target process
PID 5012 set thread context of 344	5012	toolspab2.exe	toolspab2.exe
PID 4044 set thread context of 4904	4044	uabgggs	uabgggs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\106.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\106.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

toolspab2.exeuabgggs

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uabgggs
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uabgggs
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uabgggs

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

toolspab2.exe

pid	process
344	toolspab2.exe
344	toolspab2.exe
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276
3276

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

toolspab2.exeuabgggs

pid process

344 toolspab2.exe
4904 uabgggs
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 3276
Token: SeCreatePagefilePrivilege 3276

description	pid	process
Token: SeShutdownPrivilege	3276
Token: SeCreatePagefilePrivilege	3276

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

toolspab2.exe106.exeuabgggs

description	pid	process	target process
PID 5012 wrote to memory of 344	5012	toolspab2.exe	toolspab2.exe
PID 5012 wrote to memory of 344	5012	toolspab2.exe	toolspab2.exe
PID 5012 wrote to memory of 344	5012	toolspab2.exe	toolspab2.exe
PID 5012 wrote to memory of 344	5012	toolspab2.exe	toolspab2.exe
PID 5012 wrote to memory of 344	5012	toolspab2.exe	toolspab2.exe
PID 5012 wrote to memory of 344	5012	toolspab2.exe	toolspab2.exe
PID 3276 wrote to memory of 4344	3276		FA3E.exe
PID 3276 wrote to memory of 4344	3276		FA3E.exe
PID 3276 wrote to memory of 4344	3276		FA3E.exe
PID 3276 wrote to memory of 1636	3276		106.exe
PID 3276 wrote to memory of 1636	3276		106.exe
PID 3276 wrote to memory of 1636	3276		106.exe
PID 1636 wrote to memory of 3048	1636	106.exe	WindowsUpdater.exe
PID 1636 wrote to memory of 3048	1636	106.exe	WindowsUpdater.exe
PID 1636 wrote to memory of 3048	1636	106.exe	WindowsUpdater.exe
PID 4044 wrote to memory of 4904	4044	uabgggs	uabgggs
PID 4044 wrote to memory of 4904	4044	uabgggs	uabgggs
PID 4044 wrote to memory of 4904	4044	uabgggs	uabgggs
PID 4044 wrote to memory of 4904	4044	uabgggs	uabgggs
PID 4044 wrote to memory of 4904	4044	uabgggs	uabgggs
PID 4044 wrote to memory of 4904	4044	uabgggs	uabgggs

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\toolspab2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\toolspab2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:344

C:\Users\Admin\AppData\Local\Temp\FA3E.exe
C:\Users\Admin\AppData\Local\Temp\FA3E.exe
1⤵
- Executes dropped EXE
PID:4344

C:\Users\Admin\AppData\Local\Temp\106.exe
C:\Users\Admin\AppData\Local\Temp\106.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3048

C:\Users\Admin\AppData\Roaming\uabgggs
C:\Users\Admin\AppData\Roaming\uabgggs
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Users\Admin\AppData\Roaming\uabgggs
  C:\Users\Admin\AppData\Roaming\uabgggs
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\106.exe

Filesize
575KB

MD5
af4407851ed2a938677e0b9c673de2d8

SHA1
38fb83baabd8c656182c69f87a47d329943d63e3

SHA256
f168fe9e6bb65d7a472d03d4ac01cbcaca6993ec8cf7d2f64b4313f409691158

SHA512
7db8e96908f599aa76d8e7cf03243d8058ce0961262818a3c41cb1ba71f1590622c0e815858be8894adbcafee4093aaa7cde32ec3d1264e8ba27e13862891f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\106.exe

Filesize
319KB

MD5
d6cb7c03cfc2cc3446fa05b18734582e

SHA1
dd6a55ea856f7dd59907250e02b8a0f73186daa6

SHA256
e0da68e5a56e52f93fef22eb8740c56b9456d9b895d7141989839e988cb87894

SHA512
bc90ec1745e85d3893b699cfd5ba40e6285cc67a6788bd9de623a2d65ea9672f72e1f143d5b7de6326beab746129a04416ad2503d0d2b667e769d13dd10689c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\FA3E.exe

Filesize
201KB

MD5
67c6cbf32426f86fb1bd8aff0e91efaa

SHA1
6ffc81d1f2fe4bc1c4ae6c25d9117c62ea3fef1e

SHA256
7adddba69e0cbf2c1f07ecb27b32d2d8056f070d87aad49381a656c93c023f27

SHA512
3ec65c67af6bac80f354b30ba2a7379a83eb4e22ef13f44dda8f96f2ed192e9304d6834315a91e3330a43ebe6718af7e3f84a3e03e13c057859baa8e043f9def

Download Submit
C:\Users\Admin\AppData\Local\Temp\FA3E.exe

Filesize
173KB

MD5
0ab3ba1ed71ead83643f9e5db0a72e91

SHA1
3813e438648df49753d5a7ba3d2243af6452f06d

SHA256
1612f49a00c76b1da9363f5256bcafd5a8094f880ad44ad6e3dada0194d6a636

SHA512
fed8732c157860218cae6fe0636443edc88268cdc6187bddbee92d8d02c7130d9951344fdbc298b855f583d1d9978ef55dd4e0833a4daa75195d0dace161deaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe

Filesize
1.2MB

MD5
839b8f58019dc0d4aee5bf692f536c35

SHA1
0e9d2d54e5961fd77de06b599378c3da433b7a21

SHA256
df3fc7ac0148d935d0355a51fa10747cb45582f1b0bb196eac7f451d85a1b667

SHA512
20a9acce17f56968d8311f63f74070a0feeebb22b2e9373d2256b1afa3da9f83f092eecba219f9a6ea7490e70959846c68cb128284d23db875f6b17b4deeef85

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe

Filesize
882KB

MD5
4e43160997ef44acf43d6a9d43877130

SHA1
60b84402d3f57ee5318f866dd8638d0b8eeaad36

SHA256
c7512927a09eed79f39042924ac80b80a00cfd008f19e5c876ff960c1b375ac7

SHA512
e1e99bd7775ce5727984ed2b8978d21755db94cb23e9879ff55119a71348e1e74537d0fa3dfe498f9e7bc23a61a5b615686af0cad1bb31407a6f218aad18b3fa

Download Submit
C:\Users\Admin\AppData\Roaming\uabgggs

Filesize
207KB

MD5
38cb64fa3339058ae21850bb66b82279

SHA1
4ab731f54aec2b9a8c49bf5e38fe294e9745b604

SHA256
ef743dcfbc3b85460416d9708cd43452354c148b375ef94075aaa79207c6467b

SHA512
23ac1bfc8e21b879d347867e7a66af3a2b907265ce8fe415e6315ba7e1b9631c9c32d14b51e95e226661c1630f43d2d0e10e5d17705b9b6fe3200a3a1c13b3a7

Download Submit
\Users\Admin\AppData\Local\Temp\lib.dll

Filesize
990KB

MD5
8c7a66da0ce97eb314329a98f2f65d89

SHA1
a23241e1882f6ef95f50ed72d8b6a65a7529be5f

SHA256
2886ec1bdf94451d476e17e4ce6b900d1fee3b04e3001225fce4d497f5686671

SHA512
a6fa0d2f3e0875415627b2f6663bee255dbdd7ba72c5d35d66fefe6188dadaf67171aac39e625e24c72ac3eacd6a7599fd4e7f076a9ca8dcefdc355e713a0caf

Download Submit
\Users\Admin\AppData\Local\Temp\nso357.tmp\System.dll

Filesize
12KB

MD5
dd87a973e01c5d9f8e0fcc81a0af7c7a

SHA1
c9206ced48d1e5bc648b1d0f54cccc18bf643a14

SHA256
7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1

SHA512
4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f

Download Submit
memory/344-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/344-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/344-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1636-22-0x0000000000170000-0x0000000000706000-memory.dmp

Filesize
5.6MB

Download
memory/1636-26-0x0000000000170000-0x0000000000706000-memory.dmp

Filesize
5.6MB

Download
memory/3276-5-0x00000000013D0000-0x00000000013E6000-memory.dmp

Filesize
88KB

Download
memory/3276-45-0x0000000001600000-0x0000000001616000-memory.dmp

Filesize
88KB

Download
memory/4044-43-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/4904-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4904-48-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5012-2-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/5012-3-0x00000000004B0000-0x00000000004B9000-memory.dmp

Filesize
36KB

Download