smokeloader | bef19046886d0a76f0f8fbe8ca5043905884a7948fc3d535a361a4e210c9a2e3

General

Target

581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8.exe
Size

312KB
MD5

5a284c7f753ae16b6d2739e195ab6633
SHA1

7198366d058a0816fb145e09ee34034d079fccf2
SHA256

581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8
SHA512

5a376e1fc3435087c6827dd3fe3e6eaddd1f617d3beaf1e0dbd9583399d6d9b299ca9f60375c0e2398970eef04fc9ee14ba84b669422d57851caad7f083f4813
SSDEEP

3072:9j8aOxWKuLtl+dJwqdN+8WZxmw9JCzW2Y/7ZYjY5n0HQGsR1hidO:96xELH+dlY8AwCkLY/tYe0HQlji

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1256
Executes dropped EXE 2 IoCs

Processes:

7CFD.exe7F3F.exe

pid process

2416 7CFD.exe
2496 7F3F.exe

pid	process
1256

pid	process
2416	7CFD.exe
2496	7F3F.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8.exe

pid	process
2876	581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8.exe
2876	581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8.exe
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8.exe

pid process

2876 581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

description	pid	target process
PID 1256 wrote to memory of 2416	1256	7CFD.exe
PID 1256 wrote to memory of 2416	1256	7CFD.exe
PID 1256 wrote to memory of 2416	1256	7CFD.exe
PID 1256 wrote to memory of 2416	1256	7CFD.exe
PID 1256 wrote to memory of 2416	1256	7CFD.exe
PID 1256 wrote to memory of 2416	1256	7CFD.exe
PID 1256 wrote to memory of 2416	1256	7CFD.exe
PID 1256 wrote to memory of 2496	1256	7F3F.exe
PID 1256 wrote to memory of 2496	1256	7F3F.exe
PID 1256 wrote to memory of 2496	1256	7F3F.exe
PID 1256 wrote to memory of 2496	1256	7F3F.exe

C:\Users\Admin\AppData\Local\Temp\581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8.exe
"C:\Users\Admin\AppData\Local\Temp\581412f08e3333ebe7a4661f982106b1e395d3c8f384107df71db4768faec0c8.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2876

C:\Users\Admin\AppData\Local\Temp\7CFD.exe
C:\Users\Admin\AppData\Local\Temp\7CFD.exe
1⤵
- Executes dropped EXE
PID:2416

C:\Users\Admin\AppData\Local\Temp\7F3F.exe
C:\Users\Admin\AppData\Local\Temp\7F3F.exe
1⤵
- Executes dropped EXE
PID:2496

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7CFD.exe
Filesize
5.0MB

MD5
4871b0cc9f2c5d9831805ce8dbf3e51c

SHA1
15aa462a7ceba6c033064a56fa9984aa7ec15e0a

SHA256
e8b3976718b6a4a2c2c8bbe91ef6830876275ccbf78a72e8d1816328e4e627eb

SHA512
73532e6febf109aa489858ffc989bb69fdeefe8ade30261ecc9e9635e390714e77a70ca0c8ab3bc836c5318e2ec22dba1a063144fce23cbfd0dbd0b8400d0e6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7F3F.exe
Filesize
513KB

MD5
982035bc968af21d8078f6f11d420317

SHA1
036d697eb600cc0c2481b112f4475de42ca389c6

SHA256
5164258993a4db297eafcd03cadafb054a9fa9bae024ea0e047917a664c5c1b0

SHA512
bd3bedd6d1c93cec19257e5bb0b994790f9d08b9f76092cd79a3a558afc884a08c6250ef1889d4eb7a6c1a6f555d00a1a48108a63072007dc9d802b91cc24055

Download Submit
memory/1256-4-0x0000000002130000-0x0000000002146000-memory.dmp

Filesize
88KB

Download
memory/2496-22-0x0000000000010000-0x0000000000096000-memory.dmp

Filesize
536KB

Download
memory/2496-25-0x0000000000010000-0x0000000000096000-memory.dmp

Filesize
536KB

Download
memory/2876-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2876-2-0x00000000001B0000-0x00000000001BB000-memory.dmp

Filesize
44KB

Download
memory/2876-3-0x0000000000400000-0x000000000086F000-memory.dmp

Filesize
4.4MB

Download
memory/2876-5-0x0000000000400000-0x000000000086F000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads