smokeloader | bb2fc98b82c1910215e38cccc646bce1b4619a43ac67039104cab446a9cf5e4f

Analysis

max time kernel
122s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb2fc98b82c1910215e38cccc646bce1b4619a43ac67039104cab446a9cf5e4f.exe
Size

321KB
MD5

38ee9e81a37d0b0a67c0a0cd541c7173
SHA1

e063f039e77db5c73209a32c6f1c3adc56880de2
SHA256

bb2fc98b82c1910215e38cccc646bce1b4619a43ac67039104cab446a9cf5e4f
SHA512

1185436c49629b8e72f2061c5d8466a48dd8588c1974a32a737683f1e4bf7f441d395b87c8267c9743107d71acdab929fd1730922ea403e601924ce52381cd9a
SSDEEP

6144:4zp+J2ikZlnBs34qRFBHxGbdAfoChbwEFmKETX:4dZikzBs34qBRGB1Y2R

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2096 2064 WerFault.exe bb2fc98b82c1910215e38cccc646bce1b4619a43ac67039104cab446a9cf5e4f.exe

pid	pid_target	process	target process
2096	2064	WerFault.exe	bb2fc98b82c1910215e38cccc646bce1b4619a43ac67039104cab446a9cf5e4f.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

bb2fc98b82c1910215e38cccc646bce1b4619a43ac67039104cab446a9cf5e4f.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bb2fc98b82c1910215e38cccc646bce1b4619a43ac67039104cab446a9cf5e4f.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bb2fc98b82c1910215e38cccc646bce1b4619a43ac67039104cab446a9cf5e4f.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bb2fc98b82c1910215e38cccc646bce1b4619a43ac67039104cab446a9cf5e4f.exe

C:\Users\Admin\AppData\Local\Temp\bb2fc98b82c1910215e38cccc646bce1b4619a43ac67039104cab446a9cf5e4f.exe
"C:\Users\Admin\AppData\Local\Temp\bb2fc98b82c1910215e38cccc646bce1b4619a43ac67039104cab446a9cf5e4f.exe"
1⤵
- Checks SCSI registry key(s)
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 360
2⤵
- Program crash
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2064 -ip 2064
1⤵
PID:456

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-1-0x0000000003020000-0x0000000003120000-memory.dmp

Filesize
1024KB

Download
memory/2064-2-0x0000000002FD0000-0x0000000002FDB000-memory.dmp

Filesize
44KB

Download
memory/2064-3-0x0000000000400000-0x0000000002D2E000-memory.dmp

Filesize
41.2MB

Download
memory/2064-4-0x0000000000400000-0x0000000002D2E000-memory.dmp

Filesize
41.2MB

Download