smokeloader | 44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452

Analysis

max time kernel
292s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240319-en
resource tags

arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system
submitted
01-04-2024 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452.exe
Size

203KB
MD5

2c4aebcc97030695e4eae570e2aa1f1a
SHA1

b43be65cd79153d07a8959d06583a87650c59699
SHA256

44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452
SHA512

fa99384bc9b5ccb21f0859576d3a420ad6118849fe2892c53e7782096a14d3b9ceb86fb528ce362612d131194c5562ba57190315359e2573564bb2267297f8ee
SSDEEP

3072:bKIdo3wKvh4ZsXLK0aWcfX98+8spxn0bDU+OWJ:bK/3wKvh4ZXnX98Bs3nk

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1588 4264 WerFault.exe 44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452.exe

pid	pid_target	process	target process
1588	4264	WerFault.exe	44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452.exe

C:\Users\Admin\AppData\Local\Temp\44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452.exe
"C:\Users\Admin\AppData\Local\Temp\44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452.exe"
1⤵
- Checks SCSI registry key(s)
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 492
2⤵
- Program crash
PID:1588

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4264-1-0x00000000006F0000-0x00000000007F0000-memory.dmp

Filesize
1024KB

Download
memory/4264-2-0x00000000005A0000-0x00000000005AB000-memory.dmp

Filesize
44KB

Download
memory/4264-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4264-6-0x00000000006F0000-0x00000000007F0000-memory.dmp

Filesize
1024KB

Download