smokeloader | 4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858

General

Target

4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858.exe
Size

270KB
MD5

cccb10ceec06dcd07535387e28224db5
SHA1

9d9e4dccfe75ed49f3b6c89f446654d4d91f63c7
SHA256

4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858
SHA512

66a45dcb0401d6f9b93c6795983eaec6721ccd36918a69bae4877b0fd4a06e666b190676d27d32f96a5005a44a6a9e8f37b75e26b49e33d3fb893485ebc61e80
SSDEEP

3072:s/ZZBAvpmGkYrX15+VNX2VvXa4WNCqyEuHTP5QrTFWpc1nCKPTsyWj3cDe4:oZBar15FDWNpg72rTcpqCKP433cD

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1224
Executes dropped EXE 1 IoCs

Processes:

vcaftte

pid process

1324 vcaftte

pid	process
1224

pid	process
1324	vcaftte

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858.exevcaftte

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vcaftte
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vcaftte
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vcaftte

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858.exe

pid	process
1948	4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858.exe
1948	4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858.exe
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858.exevcaftte

pid process

1948 4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858.exe
1324 vcaftte
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 1224

description	pid	process
Token: SeShutdownPrivilege	1224

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2868 wrote to memory of 1324	2868	taskeng.exe	vcaftte
PID 2868 wrote to memory of 1324	2868	taskeng.exe	vcaftte
PID 2868 wrote to memory of 1324	2868	taskeng.exe	vcaftte
PID 2868 wrote to memory of 1324	2868	taskeng.exe	vcaftte

C:\Users\Admin\AppData\Local\Temp\4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858.exe
"C:\Users\Admin\AppData\Local\Temp\4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1948

C:\Windows\system32\taskeng.exe
taskeng.exe {04FF739B-C8DD-46FB-B2ED-7B82B66FDEBF} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2868

C:\Users\Admin\AppData\Roaming\vcaftte
C:\Users\Admin\AppData\Roaming\vcaftte
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1324

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\vcaftte
Filesize
270KB

MD5
cccb10ceec06dcd07535387e28224db5

SHA1
9d9e4dccfe75ed49f3b6c89f446654d4d91f63c7

SHA256
4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858

SHA512
66a45dcb0401d6f9b93c6795983eaec6721ccd36918a69bae4877b0fd4a06e666b190676d27d32f96a5005a44a6a9e8f37b75e26b49e33d3fb893485ebc61e80

Download Submit
memory/1224-4-0x0000000002980000-0x0000000002996000-memory.dmp

Filesize
88KB

Download
memory/1224-16-0x0000000002FC0000-0x0000000002FD6000-memory.dmp

Filesize
88KB

Download
memory/1324-15-0x0000000000400000-0x0000000000AEC000-memory.dmp

Filesize
6.9MB

Download
memory/1324-14-0x0000000000C80000-0x0000000000D80000-memory.dmp

Filesize
1024KB

Download
memory/1324-19-0x0000000000400000-0x0000000000AEC000-memory.dmp

Filesize
6.9MB

Download
memory/1948-1-0x0000000000C50000-0x0000000000D50000-memory.dmp

Filesize
1024KB

Download
memory/1948-2-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/1948-3-0x0000000000400000-0x0000000000AEC000-memory.dmp

Filesize
6.9MB

Download
memory/1948-5-0x0000000000400000-0x0000000000AEC000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads