smokeloader | 25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542

General

Target

25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542.exe
Size

276KB
MD5

047caf966f576f668c8b0486c668db8d
SHA1

75114f4e85e8884c36a723b61ed1f8c134eda375
SHA256

25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542
SHA512

8cf144edfadb11b8b906febddb7d58484e028ba487ceec0ca311d8bd1dc45799cd44c6bb635035ee05581aa18bb490b1d4642f89738d133f519df793084d02f4
SSDEEP

3072:wKLltcY6Kh6VO5zVwMxj7zEvi/ZFHARFjn7T5dmdf1:VLkY60pzVHxHEviTcD7O

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1264
Executes dropped EXE 1 IoCs

Processes:

ctfjjit

pid process

832 ctfjjit

pid	process
1264

pid	process
832	ctfjjit

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ctfjjit25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ctfjjit
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ctfjjit
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ctfjjit

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542.exe

pid	process
1728	25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542.exe
1728	25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542.exe
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542.exectfjjit

pid process

1728 25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542.exe
832 ctfjjit
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 1264

description	pid	process
Token: SeShutdownPrivilege	1264

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1588 wrote to memory of 832	1588	taskeng.exe	ctfjjit
PID 1588 wrote to memory of 832	1588	taskeng.exe	ctfjjit
PID 1588 wrote to memory of 832	1588	taskeng.exe	ctfjjit
PID 1588 wrote to memory of 832	1588	taskeng.exe	ctfjjit

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542.exe
"C:\Users\Admin\AppData\Local\Temp\25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1728

C:\Windows\system32\taskeng.exe
taskeng.exe {3019CD11-85CD-4B51-9D8B-EF8F03D879EE} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Roaming\ctfjjit
C:\Users\Admin\AppData\Roaming\ctfjjit
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:832

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ctfjjit
Filesize
276KB

MD5
047caf966f576f668c8b0486c668db8d

SHA1
75114f4e85e8884c36a723b61ed1f8c134eda375

SHA256
25bc7b4372bd09d3489a97dab7c303b1570b1b659bd691380f0a7667378e8542

SHA512
8cf144edfadb11b8b906febddb7d58484e028ba487ceec0ca311d8bd1dc45799cd44c6bb635035ee05581aa18bb490b1d4642f89738d133f519df793084d02f4

Download Submit
memory/832-14-0x00000000009E0000-0x0000000000AE0000-memory.dmp

Filesize
1024KB

Download
memory/832-15-0x0000000000400000-0x0000000000847000-memory.dmp

Filesize
4.3MB

Download
memory/832-17-0x0000000000400000-0x0000000000847000-memory.dmp

Filesize
4.3MB

Download
memory/1264-4-0x0000000002200000-0x0000000002216000-memory.dmp

Filesize
88KB

Download
memory/1264-16-0x0000000002970000-0x0000000002986000-memory.dmp

Filesize
88KB

Download
memory/1728-2-0x00000000001B0000-0x00000000001BB000-memory.dmp

Filesize
44KB

Download
memory/1728-3-0x0000000000400000-0x0000000000847000-memory.dmp

Filesize
4.3MB

Download
memory/1728-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/1728-5-0x0000000000400000-0x0000000000847000-memory.dmp

Filesize
4.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads