smokeloader | 4a5fb962dcf9b00e84661eae9e8a679423ab7033d825ad018b5e797c6c83c9b2

General

Target

a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe
Size

223KB
MD5

553cc8aee992da42454595e76d7afb37
SHA1

47a5850ad4c2b7e6708fa28300f8fdaf54839ebf
SHA256

a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b
SHA512

68ae6e2805e2a2281de7b8cb934dd82e44bfd75027bc447a622f5dee562f64ae4dc23285c6c1b9f6b2fb2f339e3a24e872a8e1b05e03f8b0f4ecf4632e5fba18
SSDEEP

6144:u4sxL7SMoJcll5+CZNdX9O3LidITCW2HTfKs0qxIT:u4UHSMecXhJg3LiGTCW2HDKrqi

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://dublebomber.ru/

http://yavasponimayu.ru/

http://nomnetozhedenyuzhkanuzhna.ru/

http://prostosmeritesya.ru/

http://ipoluchayteudovolstvie.ru/

http://super777bomba.ru/

http://specnaznachenie.ru/

http://zakrylki809.ru/

http://propertyminsk.by/

http://iloveua.ir/

http://moyabelorussiya.by/

http://tvoyaradostetoya.ru/

http://zasadacafe.by/

http://restmantra.by/

http://kozachok777.ru/

http://propertyiran.ir/

http://sakentoshi.ru/

http://popuasyfromua.ru/

http://diplombar.by/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1280
Executes dropped EXE 1 IoCs

Processes:

eubtwrc

pid process

1060 eubtwrc

pid	process
1280

pid	process
1060	eubtwrc

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

eubtwrca8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eubtwrc
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eubtwrc
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eubtwrc

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe

pid	process
2216	a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe
2216	a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280
1280

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exeeubtwrc

pid process

2216 a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe
1060 eubtwrc

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2792 wrote to memory of 1060	2792	taskeng.exe	eubtwrc
PID 2792 wrote to memory of 1060	2792	taskeng.exe	eubtwrc
PID 2792 wrote to memory of 1060	2792	taskeng.exe	eubtwrc
PID 2792 wrote to memory of 1060	2792	taskeng.exe	eubtwrc

C:\Users\Admin\AppData\Local\Temp\a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe
"C:\Users\Admin\AppData\Local\Temp\a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2216

C:\Windows\system32\taskeng.exe
taskeng.exe {31B93993-B969-457E-9E03-B867135FC34C} S-1-5-21-406356229-2805545415-1236085040-1000:IKJSPGIM\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Users\Admin\AppData\Roaming\eubtwrc
C:\Users\Admin\AppData\Roaming\eubtwrc
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1060

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\eubtwrc
Filesize
223KB

MD5
553cc8aee992da42454595e76d7afb37

SHA1
47a5850ad4c2b7e6708fa28300f8fdaf54839ebf

SHA256
a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b

SHA512
68ae6e2805e2a2281de7b8cb934dd82e44bfd75027bc447a622f5dee562f64ae4dc23285c6c1b9f6b2fb2f339e3a24e872a8e1b05e03f8b0f4ecf4632e5fba18

Download Submit
memory/1060-13-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1060-15-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1280-3-0x00000000026C0000-0x00000000026D6000-memory.dmp

Filesize
88KB

Download
memory/1280-14-0x0000000002700000-0x0000000002716000-memory.dmp

Filesize
88KB

Download
memory/2216-0-0x0000000000220000-0x0000000000235000-memory.dmp

Filesize
84KB

Download
memory/2216-1-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/2216-2-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2216-4-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2216-7-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads