smokeloader | ec096a9de3f8597eeac6ca03f8afd525482f913d92bd2e60a2bfea21747edae8

General

Target

30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe
Size

243KB
MD5

eceb992b85b4b71ebbb9e18176927d90
SHA1

33dbf17a76eb79971f7bec537b6e4d03e522608e
SHA256

30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad
SHA512

0e784fe4212019f1dcd7126672824b84eaba05d036da8a9ef4183e26cb95bc16cb070ffe6f7a78067a59a8cb715f5569b3942c87b14356ef80caf0d43306f634
SSDEEP

3072:+5wJ2lvSrbBrRWGIGf/qs5WATCz0J4d/87GkcgTdNRunrcSO4Dtl16/AaqP:h2lvSrqB7AAR/8+zrNh

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1208
Executes dropped EXE 3 IoCs

Processes:

eawgusdCE47.exeD0A8.exe

pid process

2684 eawgusd
2516 CE47.exe
1728 D0A8.exe

pid	process
1208

pid	process
2684	eawgusd
2516	CE47.exe
1728	D0A8.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

eawgusd30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eawgusd
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eawgusd
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eawgusd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe

pid	process
1688	30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe
1688	30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exeeawgusd

pid process

1688 30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe
2684 eawgusd

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2600 wrote to memory of 2684	2600	taskeng.exe	eawgusd
PID 2600 wrote to memory of 2684	2600	taskeng.exe	eawgusd
PID 2600 wrote to memory of 2684	2600	taskeng.exe	eawgusd
PID 2600 wrote to memory of 2684	2600	taskeng.exe	eawgusd
PID 1208 wrote to memory of 2516	1208		CE47.exe
PID 1208 wrote to memory of 2516	1208		CE47.exe
PID 1208 wrote to memory of 2516	1208		CE47.exe
PID 1208 wrote to memory of 2516	1208		CE47.exe
PID 1208 wrote to memory of 2516	1208		CE47.exe
PID 1208 wrote to memory of 2516	1208		CE47.exe
PID 1208 wrote to memory of 2516	1208		CE47.exe
PID 1208 wrote to memory of 1728	1208		D0A8.exe
PID 1208 wrote to memory of 1728	1208		D0A8.exe
PID 1208 wrote to memory of 1728	1208		D0A8.exe
PID 1208 wrote to memory of 1728	1208		D0A8.exe

C:\Users\Admin\AppData\Local\Temp\30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe
"C:\Users\Admin\AppData\Local\Temp\30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1688

C:\Windows\system32\taskeng.exe
taskeng.exe {C6C86307-29E2-472F-BEB3-12F10760FBBA} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Users\Admin\AppData\Roaming\eawgusd
C:\Users\Admin\AppData\Roaming\eawgusd
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2684

C:\Users\Admin\AppData\Local\Temp\CE47.exe
C:\Users\Admin\AppData\Local\Temp\CE47.exe
1⤵
- Executes dropped EXE
PID:2516

C:\Users\Admin\AppData\Local\Temp\D0A8.exe
C:\Users\Admin\AppData\Local\Temp\D0A8.exe
1⤵
- Executes dropped EXE
PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CE47.exe
Filesize
5.0MB

MD5
4871b0cc9f2c5d9831805ce8dbf3e51c

SHA1
15aa462a7ceba6c033064a56fa9984aa7ec15e0a

SHA256
e8b3976718b6a4a2c2c8bbe91ef6830876275ccbf78a72e8d1816328e4e627eb

SHA512
73532e6febf109aa489858ffc989bb69fdeefe8ade30261ecc9e9635e390714e77a70ca0c8ab3bc836c5318e2ec22dba1a063144fce23cbfd0dbd0b8400d0e6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\D0A8.exe
Filesize
513KB

MD5
982035bc968af21d8078f6f11d420317

SHA1
036d697eb600cc0c2481b112f4475de42ca389c6

SHA256
5164258993a4db297eafcd03cadafb054a9fa9bae024ea0e047917a664c5c1b0

SHA512
bd3bedd6d1c93cec19257e5bb0b994790f9d08b9f76092cd79a3a558afc884a08c6250ef1889d4eb7a6c1a6f555d00a1a48108a63072007dc9d802b91cc24055

Download Submit
C:\Users\Admin\AppData\Roaming\eawgusd
Filesize
243KB

MD5
eceb992b85b4b71ebbb9e18176927d90

SHA1
33dbf17a76eb79971f7bec537b6e4d03e522608e

SHA256
30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad

SHA512
0e784fe4212019f1dcd7126672824b84eaba05d036da8a9ef4183e26cb95bc16cb070ffe6f7a78067a59a8cb715f5569b3942c87b14356ef80caf0d43306f634

Download Submit
memory/1208-4-0x00000000025C0000-0x00000000025D6000-memory.dmp

Filesize
88KB

Download
memory/1208-16-0x00000000025E0000-0x00000000025F6000-memory.dmp

Filesize
88KB

Download
memory/1688-2-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/1688-3-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1688-5-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1688-1-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/1728-31-0x0000000000010000-0x0000000000096000-memory.dmp

Filesize
536KB

Download
memory/1728-34-0x0000000000010000-0x0000000000096000-memory.dmp

Filesize
536KB

Download
memory/2684-14-0x0000000000890000-0x0000000000990000-memory.dmp

Filesize
1024KB

Download
memory/2684-19-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2684-15-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads