smokeloader | 991953553326f76413a024a057251b539e0c3e335208128cec2d6a7c724a2c69

Resubmissions

10/04/2024, 03:06

240410-dl3mrace2210

10/04/2024, 03:06

10/04/2024, 03:06

10/04/2024, 03:06

26/02/2024, 03:30

Analysis

max time kernel
590s
max time network
393s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
10/04/2024, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98c3d93eeb1c3139c530df4aa6270bb3df7c24148e71f195c929486136872eee.exe
Size 253KB
Sample240410-dl2epacd98
SHA256 98c3d93eeb1c3139c530df4aa6270bb3df7c24148e71f195c929486136872eee
MD5 c725af162ad3190c0b65770fb08fbe23
SHA1 521eae0390bef9140f9a6e896066515ca7a98c5d
SHA512 6fe7edc75ee4d52ace5450a211362808a4c24a41ae67d1e74dabd3adc687349dba35743acc4cd96e37c1d2701f03c6511a1127773f0aeb480f7025556bb3e59e
SSDEEP 3072:yLsGBVVoWaf88khIqzHdWu7zCJDBfukHimJ3a1XMu5Q2e45KaHTz:UdebOLo6+JDNukHbJ3+k2YqT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4676	4604	WerFault.exe	72

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	98c3d93eeb1c3139c530df4aa6270bb3df7c24148e71f195c929486136872eee.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	98c3d93eeb1c3139c530df4aa6270bb3df7c24148e71f195c929486136872eee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	98c3d93eeb1c3139c530df4aa6270bb3df7c24148e71f195c929486136872eee.exe

C:\Users\Admin\AppData\Local\Temp\98c3d93eeb1c3139c530df4aa6270bb3df7c24148e71f195c929486136872eee.exe
"C:\Users\Admin\AppData\Local\Temp\98c3d93eeb1c3139c530df4aa6270bb3df7c24148e71f195c929486136872eee.exe"
1⤵
- Checks SCSI registry key(s)
PID:4604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 488
  2⤵
  - Program crash
  PID:4676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4604-1-0x0000000002FC0000-0x00000000030C0000-memory.dmp

Download

memory/4604-2-0x0000000002E70000-0x0000000002E7B000-memory.dmp

Download

memory/4604-3-0x0000000000400000-0x0000000002D3E000-memory.dmp

Download

memory/4604-6-0x0000000002FC0000-0x00000000030C0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads