smokeloader | a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d

General

Target

a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe
Size

296KB
MD5

149fd2af87560517461896494348b0b5
SHA1

46236249a25cb2e763b7ef51183f816888fcd5b3
SHA256

a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d
SHA512

65f92c1d1d09084b5a17fa5860fab8187042df1ac07742d8acd814dbf7d6a8dcabc7eb979fafc22d282c7ed90675f6db18b8da94c5aff80b90193e475b9de86e
SSDEEP

3072:FseCPxLfW0ZwuKTLnDTL52XVMQ6BHVgXCjnoXnP5ZgSoz5iuj87:FEPxLFwXLHQXVB6BHVeMUnPRuj

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1256
Executes dropped EXE 1 IoCs

Processes:

tvrfedj

pid process

1932 tvrfedj

pid	process
1256

pid	process
1932	tvrfedj

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exetvrfedj

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tvrfedj
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tvrfedj
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tvrfedj

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe

pid	process
2872	a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe
2872	a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exetvrfedj

pid process

2872 a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe
1932 tvrfedj
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 1256

description	pid	process
Token: SeShutdownPrivilege	1256

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1972 wrote to memory of 1932	1972	taskeng.exe	tvrfedj
PID 1972 wrote to memory of 1932	1972	taskeng.exe	tvrfedj
PID 1972 wrote to memory of 1932	1972	taskeng.exe	tvrfedj
PID 1972 wrote to memory of 1932	1972	taskeng.exe	tvrfedj

C:\Users\Admin\AppData\Local\Temp\a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe
"C:\Users\Admin\AppData\Local\Temp\a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2872

C:\Windows\system32\taskeng.exe
taskeng.exe {057A104F-F319-4C0C-9664-CD3BA8DC1DD6} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Roaming\tvrfedj
C:\Users\Admin\AppData\Roaming\tvrfedj
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1932

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\tvrfedj
Filesize
296KB

MD5
149fd2af87560517461896494348b0b5

SHA1
46236249a25cb2e763b7ef51183f816888fcd5b3

SHA256
a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d

SHA512
65f92c1d1d09084b5a17fa5860fab8187042df1ac07742d8acd814dbf7d6a8dcabc7eb979fafc22d282c7ed90675f6db18b8da94c5aff80b90193e475b9de86e

Download Submit
memory/1256-4-0x0000000002130000-0x0000000002146000-memory.dmp

Filesize
88KB

Download
memory/1256-16-0x0000000002690000-0x00000000026A6000-memory.dmp

Filesize
88KB

Download
memory/1932-14-0x0000000002D40000-0x0000000002E40000-memory.dmp

Filesize
1024KB

Download
memory/1932-15-0x0000000000400000-0x0000000002C2D000-memory.dmp

Filesize
40.2MB

Download
memory/1932-17-0x0000000000400000-0x0000000002C2D000-memory.dmp

Filesize
40.2MB

Download
memory/2872-1-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/2872-2-0x0000000000400000-0x0000000002C2D000-memory.dmp

Filesize
40.2MB

Download
memory/2872-3-0x00000000001B0000-0x00000000001BB000-memory.dmp

Filesize
44KB

Download
memory/2872-5-0x0000000000400000-0x0000000002C2D000-memory.dmp

Filesize
40.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads