smokeloader | 4a5fb962dcf9b00e84661eae9e8a679423ab7033d825ad018b5e797c6c83c9b2

Analysis

max time kernel
144s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe
Size

223KB
MD5

553cc8aee992da42454595e76d7afb37
SHA1

47a5850ad4c2b7e6708fa28300f8fdaf54839ebf
SHA256

a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b
SHA512

68ae6e2805e2a2281de7b8cb934dd82e44bfd75027bc447a622f5dee562f64ae4dc23285c6c1b9f6b2fb2f339e3a24e872a8e1b05e03f8b0f4ecf4632e5fba18
SSDEEP

6144:u4sxL7SMoJcll5+CZNdX9O3LidITCW2HTfKs0qxIT:u4UHSMecXhJg3LiGTCW2HDKrqi

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2616 3816 WerFault.exe a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe

pid	pid_target	process	target process
2616	3816	WerFault.exe	a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe

C:\Users\Admin\AppData\Local\Temp\a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe
"C:\Users\Admin\AppData\Local\Temp\a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b.exe"
1⤵
- Checks SCSI registry key(s)
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 352
2⤵
- Program crash
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3816 -ip 3816
1⤵
PID:2212

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3816-0-0x0000000002230000-0x0000000002245000-memory.dmp

Filesize
84KB

Download
memory/3816-1-0x00000000001C0000-0x00000000001CB000-memory.dmp

Filesize
44KB

Download
memory/3816-2-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/3816-3-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/3816-6-0x00000000001C0000-0x00000000001CB000-memory.dmp

Filesize
44KB

Download
memory/3816-7-0x0000000002230000-0x0000000002245000-memory.dmp

Filesize
84KB

Download