smokeloader | ec096a9de3f8597eeac6ca03f8afd525482f913d92bd2e60a2bfea21747edae8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe
Size

243KB
MD5

eceb992b85b4b71ebbb9e18176927d90
SHA1

33dbf17a76eb79971f7bec537b6e4d03e522608e
SHA256

30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad
SHA512

0e784fe4212019f1dcd7126672824b84eaba05d036da8a9ef4183e26cb95bc16cb070ffe6f7a78067a59a8cb715f5569b3942c87b14356ef80caf0d43306f634
SSDEEP

3072:+5wJ2lvSrbBrRWGIGf/qs5WATCz0J4d/87GkcgTdNRunrcSO4Dtl16/AaqP:h2lvSrqB7AAR/8+zrNh

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4024 4692 WerFault.exe 30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe

pid	pid_target	process	target process
4024	4692	WerFault.exe	30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe

C:\Users\Admin\AppData\Local\Temp\30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe
"C:\Users\Admin\AppData\Local\Temp\30608da257143510f5ae45ac0bb9c1f1dc4db384fe2bf86110c1fc6a1863e9ad.exe"
1⤵
- Checks SCSI registry key(s)
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 352
2⤵
- Program crash
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4692 -ip 4692
1⤵
PID:3084

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4692-1-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/4692-2-0x0000000002050000-0x000000000205B000-memory.dmp

Filesize
44KB

Download
memory/4692-3-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download