smokeloader | bc7a7c82616beb648a3b44f3009b33962c8a7e593bfb0dcf238b406c71c4349f

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d993da5b179af8c4c4a3a29ba72182f51e47311205c7830f9cca88ec71328240.exe
Size

201KB
MD5

f3f4a4624d1582e449b54bb8df87ce03
SHA1

87d3fe682b21f26708a1ad47d8abfe14c745016d
SHA256

d993da5b179af8c4c4a3a29ba72182f51e47311205c7830f9cca88ec71328240
SHA512

d706dd6e4157560f381456a4aafd517194162ae6a85e9644caaa9fafcd28217ecaba4c71631299ca3ffea505b1ea99ddb80422fdbe3f07fa1962eaaf09cdbac1
SSDEEP

3072:X894PLOYs3gaZRjtceAOkBPJKDrWNXkprqo6+hrPREQpCfG+o:M9gLOY4gaZFmRpJKGArFFPRuf4

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

984 1448 WerFault.exe d993da5b179af8c4c4a3a29ba72182f51e47311205c7830f9cca88ec71328240.exe

pid	pid_target	process	target process
984	1448	WerFault.exe	d993da5b179af8c4c4a3a29ba72182f51e47311205c7830f9cca88ec71328240.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

d993da5b179af8c4c4a3a29ba72182f51e47311205c7830f9cca88ec71328240.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d993da5b179af8c4c4a3a29ba72182f51e47311205c7830f9cca88ec71328240.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d993da5b179af8c4c4a3a29ba72182f51e47311205c7830f9cca88ec71328240.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d993da5b179af8c4c4a3a29ba72182f51e47311205c7830f9cca88ec71328240.exe

C:\Users\Admin\AppData\Local\Temp\d993da5b179af8c4c4a3a29ba72182f51e47311205c7830f9cca88ec71328240.exe
"C:\Users\Admin\AppData\Local\Temp\d993da5b179af8c4c4a3a29ba72182f51e47311205c7830f9cca88ec71328240.exe"
1⤵
- Checks SCSI registry key(s)
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 464
2⤵
- Program crash
PID:984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1448 -ip 1448
1⤵
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-1-0x0000000000AC0000-0x0000000000BC0000-memory.dmp

Filesize
1024KB

Download
memory/1448-2-0x00000000008E0000-0x00000000008EB000-memory.dmp

Filesize
44KB

Download
memory/1448-3-0x0000000000400000-0x0000000000855000-memory.dmp

Filesize
4.3MB

Download
memory/1448-4-0x0000000000400000-0x0000000000855000-memory.dmp

Filesize
4.3MB

Download
memory/1448-5-0x00000000008E0000-0x00000000008EB000-memory.dmp

Filesize
44KB

Download