smokeloader | 55424ba52333947a5827238ff2b0905a9ae90c92fb7e9f0d165cbed47dffc47b

Analysis

max time kernel
150s
max time network
130s
platform
windows10-1703_x64
resource
win10-20231220-en
resource tags

arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
submitted
14-01-2024 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

toolspab3.exe
Size

208KB
MD5

79d36a2a84827ac86f9e30d31cf5b5dd
SHA1

01432852b4c3d1d1d17d45cde7bdbab0be214fce
SHA256

55424ba52333947a5827238ff2b0905a9ae90c92fb7e9f0d165cbed47dffc47b
SHA512

b0364ce3ca20f32846d2a5ca89cbc92113d52406907ca1c5918bf8d14f826dfa9f738c002a4efbb5ef7bbc30bf31f59d4285b1816d3f695d69cf0f2113ec1388
SSDEEP

3072:RXNxbPxb1GXDbcqUkNO5LntzXCXKX24xVad5E0OtTn7922cDD:13bJb1GzPNMntSXnEad5etTn7o26

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 5 IoCs

pid	Process
2288	C89F.exe
4796	CC79.exe
660	WindowsUpdater.exe
2800	tdfceid
2716	tdfceid

Loads dropped DLL 2 IoCs

pid	Process
660	WindowsUpdater.exe
660	WindowsUpdater.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 316 set thread context of 5044	316	toolspab3.exe	74
PID 2800 set thread context of 2716	2800	tdfceid	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	5044	WerFault.exe	74

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral2/files/0x000700000001aba1-21.dat	nsis_installer_2
behavioral2/files/0x000700000001aba1-22.dat	nsis_installer_2
behavioral2/files/0x000600000001aba2-27.dat	nsis_installer_1
behavioral2/files/0x000600000001aba2-27.dat	nsis_installer_2
behavioral2/files/0x000600000001aba2-29.dat	nsis_installer_1
behavioral2/files/0x000600000001aba2-29.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5044	toolspab3.exe
5044	toolspab3.exe
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5044	toolspab3.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3420	Process not Found
Token: SeCreatePagefilePrivilege	3420	Process not Found
Token: SeShutdownPrivilege	3420	Process not Found
Token: SeCreatePagefilePrivilege	3420	Process not Found
Token: SeShutdownPrivilege	3420	Process not Found
Token: SeCreatePagefilePrivilege	3420	Process not Found
Token: SeShutdownPrivilege	3420	Process not Found
Token: SeCreatePagefilePrivilege	3420	Process not Found
Token: SeShutdownPrivilege	3420	Process not Found
Token: SeCreatePagefilePrivilege	3420	Process not Found
Token: SeShutdownPrivilege	3420	Process not Found
Token: SeCreatePagefilePrivilege	3420	Process not Found

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 5044	316	toolspab3.exe	74
PID 316 wrote to memory of 5044	316	toolspab3.exe	74
PID 316 wrote to memory of 5044	316	toolspab3.exe	74
PID 316 wrote to memory of 5044	316	toolspab3.exe	74
PID 316 wrote to memory of 5044	316	toolspab3.exe	74
PID 316 wrote to memory of 5044	316	toolspab3.exe	74
PID 3420 wrote to memory of 2288	3420	Process not Found	77
PID 3420 wrote to memory of 2288	3420	Process not Found	77
PID 3420 wrote to memory of 2288	3420	Process not Found	77
PID 3420 wrote to memory of 4796	3420	Process not Found	78
PID 3420 wrote to memory of 4796	3420	Process not Found	78
PID 3420 wrote to memory of 4796	3420	Process not Found	78
PID 4796 wrote to memory of 660	4796	CC79.exe	79
PID 4796 wrote to memory of 660	4796	CC79.exe	79
PID 4796 wrote to memory of 660	4796	CC79.exe	79
PID 2800 wrote to memory of 2716	2800	tdfceid	81
PID 2800 wrote to memory of 2716	2800	tdfceid	81
PID 2800 wrote to memory of 2716	2800	tdfceid	81
PID 2800 wrote to memory of 2716	2800	tdfceid	81
PID 2800 wrote to memory of 2716	2800	tdfceid	81
PID 2800 wrote to memory of 2716	2800	tdfceid	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\toolspab3.exe
"C:\Users\Admin\AppData\Local\Temp\toolspab3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:316
- C:\Users\Admin\AppData\Local\Temp\toolspab3.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspab3.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 504
    3⤵
    - Program crash
    PID:2908

C:\Users\Admin\AppData\Local\Temp\C89F.exe
C:\Users\Admin\AppData\Local\Temp\C89F.exe
1⤵
- Executes dropped EXE
PID:2288

C:\Users\Admin\AppData\Local\Temp\CC79.exe
C:\Users\Admin\AppData\Local\Temp\CC79.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:660

C:\Users\Admin\AppData\Roaming\tdfceid
C:\Users\Admin\AppData\Roaming\tdfceid
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Roaming\tdfceid
  C:\Users\Admin\AppData\Roaming\tdfceid
  2⤵
  - Executes dropped EXE
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C89F.exe

Filesize
360KB

MD5
80c413180b6bd0dd664adc4e0665b494

SHA1
e791e4a3391fc6b7bcb58399cd4fa3c52a06b940

SHA256
6d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880

SHA512
347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CC79.exe

Filesize
933KB

MD5
7e4f0782a05e8db797ad194707caf101

SHA1
e9371f702692abc34e7268f867caebb31f113c5a

SHA256
e67302edc80342584d8a40b085e971edfb08e04b0f687d5afc684e7fda4e3df8

SHA512
9cfd560609d29fdca1202079c10e1889c33cc7e8f5e7c0c861a9f91eb3f7c47aec050820ddca75000543f9b2601e21c9e92bb453ad4bc1cd233f9dbb14256157

Download Submit
C:\Users\Admin\AppData\Local\Temp\CC79.exe

Filesize
1003KB

MD5
bf9138372d7f5ce657102e3c0a09a042

SHA1
30916bcb764edc464d581c81ccdaafba626a4f4f

SHA256
0e920c5e6d017ce0254ed9298a2568bedaac49a67d97810fc59f39f0a182c13b

SHA512
c42fcabf68fad149039a5dfef6e2a634ae761c0902bdb5033730c64f14a6ba28dcad924d59ee527becfc2d83b8b2751c6615d070c80952124a1b940738c4eb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe

Filesize
975KB

MD5
5b197495e6e6317af77a580eca32d1b4

SHA1
18f0c66de27ec3efc87f34e88bb4efae76a9809b

SHA256
9216896cbd3f6e77b14e1758a6992ce9ee3d2b9620525993255e33a9e0bdce4e

SHA512
296c710c01b974d06b2bc7280c004936d1dad819f4ef034e04d6b800510d3e49d5b7a5a5b6b1574d6b860da328cbb7ad75ec75d1881958bca4a8666189dc7ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe

Filesize
689KB

MD5
34ed04c2cd2e355a26bc34054c1ebc38

SHA1
2d1c1410955bc384740e51d4117d46b0c2b131b5

SHA256
6f4efb68ac843df4d25125a7f076a0546cbf51009e84fc67c1b2d9245720b3c8

SHA512
97ce15584f7aa0f47fcc7e2a4e3f9368c6d81ed66463e45d5cc13c7769a094f87fa14dc3a01de8b7f0bda094b3832894202395f7422cf01cc702af0fe5f2a331

Download Submit
C:\Users\Admin\AppData\Roaming\tdfceid

Filesize
208KB

MD5
79d36a2a84827ac86f9e30d31cf5b5dd

SHA1
01432852b4c3d1d1d17d45cde7bdbab0be214fce

SHA256
55424ba52333947a5827238ff2b0905a9ae90c92fb7e9f0d165cbed47dffc47b

SHA512
b0364ce3ca20f32846d2a5ca89cbc92113d52406907ca1c5918bf8d14f826dfa9f738c002a4efbb5ef7bbc30bf31f59d4285b1816d3f695d69cf0f2113ec1388

Download Submit
\Users\Admin\AppData\Local\Temp\lib.dll

Filesize
888KB

MD5
d00dc0b518a4b0b1e437a237232b5a1f

SHA1
40c9d35738dd0b94ee12dc1bebbf6752b334f23d

SHA256
311ea0977262a1b13330b62c374164adbff61c89c924bc37818d8ef83d4cf2a3

SHA512
b13df80edd96cfe578bd7a19bbd991c25bfdfd808ac2b6eb4f80972a2465d910838f033ff2b01d0c4f62fafbb74d285706c1d6c5e9c1436ea593ef7e952a298c

Download Submit
\Users\Admin\AppData\Local\Temp\nsyCD73.tmp\System.dll

Filesize
12KB

MD5
dd87a973e01c5d9f8e0fcc81a0af7c7a

SHA1
c9206ced48d1e5bc648b1d0f54cccc18bf643a14

SHA256
7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1

SHA512
4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f

Download Submit
memory/316-2-0x0000000000580000-0x0000000000589000-memory.dmp

Filesize
36KB

Download
memory/316-1-0x0000000000650000-0x0000000000750000-memory.dmp

Filesize
1024KB

Download
memory/2716-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2800-50-0x00000000004C0000-0x00000000005C0000-memory.dmp

Filesize
1024KB

Download
memory/3420-6-0x0000000000480000-0x0000000000496000-memory.dmp

Filesize
88KB

Download
memory/4796-24-0x0000000000140000-0x00000000006D6000-memory.dmp

Filesize
5.6MB

Download
memory/4796-28-0x0000000000140000-0x00000000006D6000-memory.dmp

Filesize
5.6MB

Download
memory/5044-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5044-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5044-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5044-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download