smokeloader | 9e5c6920cc755310726ff3ba27373a487206238dd24667a58c0c67219db79cbd

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-01-2024 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

toolspub1.exe
Size

208KB
MD5

3459e4e3b8c2023cb721b547fda205f6
SHA1

c4cc7eb4d2e016b762e685a87b16144fda258f9c
SHA256

9e5c6920cc755310726ff3ba27373a487206238dd24667a58c0c67219db79cbd
SHA512

eba48ac97ca9d2ca6626cd7fbcdb17f5a7173e03f6d8164c9b0c91902741e38043800d8815e0385ee3e57690fcc5a77d71f2c811b859e3e5d8a886b96a0070bc
SSDEEP

3072:hZvLkPRQeSXOF+t0IXvL2XvhEPA5TWdslGk5X04xZpIFvk:7LkvsO4t0k45TaDe6

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Deletes itself 1 IoCs

Processes:

pid process

3420
Executes dropped EXE 1 IoCs

Processes:

FFDC.exe

pid process

3496 FFDC.exe

pid	process
3420

pid	process
3496	FFDC.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

FFDC.exetoolspub1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	FFDC.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	FFDC.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	FFDC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

toolspub1.exe

pid	process
4308	toolspub1.exe
4308	toolspub1.exe
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

toolspub1.exeFFDC.exe

pid process

4308 toolspub1.exe
3496 FFDC.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3420

pid	process
3420

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

description	pid	target process
PID 3420 wrote to memory of 3496	3420	FFDC.exe
PID 3420 wrote to memory of 3496	3420	FFDC.exe
PID 3420 wrote to memory of 3496	3420	FFDC.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4308

C:\Users\Admin\AppData\Local\Temp\FFDC.exe
C:\Users\Admin\AppData\Local\Temp\FFDC.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3496

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FFDC.exe
Filesize
208KB

MD5
3459e4e3b8c2023cb721b547fda205f6

SHA1
c4cc7eb4d2e016b762e685a87b16144fda258f9c

SHA256
9e5c6920cc755310726ff3ba27373a487206238dd24667a58c0c67219db79cbd

SHA512
eba48ac97ca9d2ca6626cd7fbcdb17f5a7173e03f6d8164c9b0c91902741e38043800d8815e0385ee3e57690fcc5a77d71f2c811b859e3e5d8a886b96a0070bc

Download Submit
memory/3420-4-0x0000000002AD0000-0x0000000002AE6000-memory.dmp

Filesize
88KB

Download
memory/3420-18-0x00000000027B0000-0x00000000027C6000-memory.dmp

Filesize
88KB

Download
memory/3496-16-0x0000000002C50000-0x0000000002D50000-memory.dmp

Filesize
1024KB

Download
memory/3496-17-0x0000000000400000-0x0000000002B0D000-memory.dmp

Filesize
39.1MB

Download
memory/3496-19-0x0000000000400000-0x0000000002B0D000-memory.dmp

Filesize
39.1MB

Download
memory/4308-1-0x0000000002B40000-0x0000000002C40000-memory.dmp

Filesize
1024KB

Download
memory/4308-2-0x0000000002C90000-0x0000000002C9B000-memory.dmp

Filesize
44KB

Download
memory/4308-3-0x0000000000400000-0x0000000002B0D000-memory.dmp

Filesize
39.1MB

Download
memory/4308-5-0x0000000000400000-0x0000000002B0D000-memory.dmp

Filesize
39.1MB

Download