smokeloader | 4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085

General

Target

4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085.exe
Size

240KB
MD5

1f8e6e725272e0db8ad0c1c4af333b66
SHA1

059a859ea1f2fb686fb47829792620d5c19bd503
SHA256

4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085
SHA512

4bfa58cbe78acbdd2b7c9b24c7c282f701e31dfbff914345ee608ce8674a5bcb194e2d576bd0381e2a89c8c1eece3dedd1e1eebba4cf8c5b91787563791c3b39
SSDEEP

3072:h2hy9SLvBlIc8eokeq4xV61ftbenF5DW1sRKRvP5bual:Qy9SLvIcIaoFd8RH5aS

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1384
Executes dropped EXE 1 IoCs

Processes:

hghfacc

pid process

3008 hghfacc

pid	process
1384

pid	process
3008	hghfacc

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085.exehghfacc

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hghfacc
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hghfacc
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hghfacc

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085.exe

pid	process
2684	4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085.exe
2684	4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085.exe
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085.exehghfacc

pid process

2684 4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085.exe
3008 hghfacc
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 1384
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1384
1384
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1384
1384

description	pid	process
Token: SeShutdownPrivilege	1384

pid	process
1384
1384

pid	process
1384
1384

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2284 wrote to memory of 3008	2284	taskeng.exe	hghfacc
PID 2284 wrote to memory of 3008	2284	taskeng.exe	hghfacc
PID 2284 wrote to memory of 3008	2284	taskeng.exe	hghfacc
PID 2284 wrote to memory of 3008	2284	taskeng.exe	hghfacc

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085.exe
"C:\Users\Admin\AppData\Local\Temp\4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2684

C:\Windows\system32\taskeng.exe
taskeng.exe {735818F4-F8A1-4040-A386-FA0EC34E5DB1} S-1-5-21-778096762-2241304387-192235952-1000:AYFLYVMK\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2284

C:\Users\Admin\AppData\Roaming\hghfacc
C:\Users\Admin\AppData\Roaming\hghfacc
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\hghfacc

Filesize
240KB

MD5
1f8e6e725272e0db8ad0c1c4af333b66

SHA1
059a859ea1f2fb686fb47829792620d5c19bd503

SHA256
4abf06e315f2aa083da5522f8bf3dcedb3915303eb8580876499e16b068c7085

SHA512
4bfa58cbe78acbdd2b7c9b24c7c282f701e31dfbff914345ee608ce8674a5bcb194e2d576bd0381e2a89c8c1eece3dedd1e1eebba4cf8c5b91787563791c3b39

Download Submit
memory/1384-4-0x0000000002A50000-0x0000000002A66000-memory.dmp

Filesize
88KB

Download
memory/1384-16-0x00000000025E0000-0x00000000025F6000-memory.dmp

Filesize
88KB

Download
memory/2684-2-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2684-1-0x0000000002CE0000-0x0000000002DE0000-memory.dmp

Filesize
1024KB

Download
memory/2684-3-0x0000000000400000-0x0000000002C1F000-memory.dmp

Filesize
40.1MB

Download
memory/2684-5-0x0000000000400000-0x0000000002C1F000-memory.dmp

Filesize
40.1MB

Download
memory/3008-14-0x0000000003060000-0x0000000003160000-memory.dmp

Filesize
1024KB

Download
memory/3008-15-0x0000000000400000-0x0000000002C1F000-memory.dmp

Filesize
40.1MB

Download
memory/3008-19-0x0000000000400000-0x0000000002C1F000-memory.dmp

Filesize
40.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads