smokeloader | 3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6

General

Target

3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6.exe
Size

267KB
MD5

0e14a277922e7dfd198d5040a4f91378
SHA1

1c4935915171149d8cca51ec724b4de82220a4a3
SHA256

3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6
SHA512

7becf133e14279a3a0c91384e9ad4b690db76104b8a938043c4f316950b80a2a7e284fc866f0ef4c864a26e6de57650082112dd4689c651b15142e90c02033ec
SSDEEP

3072:cwnnqrJp8/jZQ7Xv93PMFvsRJF/IZ+PW2aeeUWYOKKs6vg33qG:cMqrJp8/juT1DIYzgUqPg33q

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1280
Executes dropped EXE 1 IoCs

Processes:

vehuriw

pid process

2496 vehuriw

pid	process
1280

pid	process
2496	vehuriw

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6.exevehuriw

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vehuriw
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vehuriw
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vehuriw

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6.exe

pid	process
3032	3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6.exe
3032	3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6.exe
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6.exevehuriw

pid process

3032 3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6.exe
2496 vehuriw

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2492 wrote to memory of 2496	2492	taskeng.exe	vehuriw
PID 2492 wrote to memory of 2496	2492	taskeng.exe	vehuriw
PID 2492 wrote to memory of 2496	2492	taskeng.exe	vehuriw
PID 2492 wrote to memory of 2496	2492	taskeng.exe	vehuriw

C:\Users\Admin\AppData\Local\Temp\3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6.exe
"C:\Users\Admin\AppData\Local\Temp\3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3032

C:\Windows\system32\taskeng.exe
taskeng.exe {99466E16-C4EB-4641-8AEC-FD61DC47AC0A} S-1-5-21-3787592910-3720486031-2929222812-1000:HSNHLVYA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2492

C:\Users\Admin\AppData\Roaming\vehuriw
C:\Users\Admin\AppData\Roaming\vehuriw
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2496

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\vehuriw
Filesize
267KB

MD5
0e14a277922e7dfd198d5040a4f91378

SHA1
1c4935915171149d8cca51ec724b4de82220a4a3

SHA256
3a2dc64e10511ab0ac7ca573f7542506ac46d65671b14311ea87b389ecf07ef6

SHA512
7becf133e14279a3a0c91384e9ad4b690db76104b8a938043c4f316950b80a2a7e284fc866f0ef4c864a26e6de57650082112dd4689c651b15142e90c02033ec

Download Submit
memory/1280-4-0x0000000002220000-0x0000000002236000-memory.dmp

Filesize
88KB

Download
memory/1280-17-0x0000000003B30000-0x0000000003B46000-memory.dmp

Filesize
88KB

Download
memory/2496-15-0x00000000002D0000-0x00000000003D0000-memory.dmp

Filesize
1024KB

Download
memory/2496-16-0x0000000000400000-0x0000000002B6C000-memory.dmp

Filesize
39.4MB

Download
memory/2496-20-0x0000000000400000-0x0000000002B6C000-memory.dmp

Filesize
39.4MB

Download
memory/3032-1-0x0000000002D10000-0x0000000002E10000-memory.dmp

Filesize
1024KB

Download
memory/3032-2-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/3032-3-0x0000000000400000-0x0000000002B6C000-memory.dmp

Filesize
39.4MB

Download
memory/3032-5-0x0000000000400000-0x0000000002B6C000-memory.dmp

Filesize
39.4MB

Download
memory/3032-8-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads