smokeloader | 7d44fd73a8418642bb75227ed9c37636eddb48c54d9b1b5370ccf85aa2a7ee0e

Analysis

max time kernel
293s
max time network
306s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-04-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d44fd73a8418642bb75227ed9c37636eddb48c54d9b1b5370ccf85aa2a7ee0e.exe
Size

240KB
MD5

5cda9f770634fb63a62aa0ebcad24ef7
SHA1

dcd89bbac906e42782999d94b0587d8a3c7efbb8
SHA256

7d44fd73a8418642bb75227ed9c37636eddb48c54d9b1b5370ccf85aa2a7ee0e
SHA512

88ebcce21f36d3850877c35ab851c420776dacc3ee0870879f5cc1896a849259cddceff762e5c247961090f7b177b97b3740bc74a39f73fab3a97138dd8a07aa
SSDEEP

3072:lHAEDKL/WUXe0NiCJxJI0ZvB0okKDyozVeTe5ufBfVvUBeU6:GLu4XQLiZ0okLmCd1VvU1

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3768 4428 WerFault.exe 7d44fd73a8418642bb75227ed9c37636eddb48c54d9b1b5370ccf85aa2a7ee0e.exe

pid	pid_target	process	target process
3768	4428	WerFault.exe	7d44fd73a8418642bb75227ed9c37636eddb48c54d9b1b5370ccf85aa2a7ee0e.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

7d44fd73a8418642bb75227ed9c37636eddb48c54d9b1b5370ccf85aa2a7ee0e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7d44fd73a8418642bb75227ed9c37636eddb48c54d9b1b5370ccf85aa2a7ee0e.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7d44fd73a8418642bb75227ed9c37636eddb48c54d9b1b5370ccf85aa2a7ee0e.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7d44fd73a8418642bb75227ed9c37636eddb48c54d9b1b5370ccf85aa2a7ee0e.exe

C:\Users\Admin\AppData\Local\Temp\7d44fd73a8418642bb75227ed9c37636eddb48c54d9b1b5370ccf85aa2a7ee0e.exe
"C:\Users\Admin\AppData\Local\Temp\7d44fd73a8418642bb75227ed9c37636eddb48c54d9b1b5370ccf85aa2a7ee0e.exe"
1⤵
- Checks SCSI registry key(s)
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 492
2⤵
- Program crash
PID:3768

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4428-1-0x0000000002D70000-0x0000000002E70000-memory.dmp

Filesize
1024KB

Download
memory/4428-2-0x0000000002D60000-0x0000000002D6B000-memory.dmp

Filesize
44KB

Download
memory/4428-3-0x0000000000400000-0x0000000002C1F000-memory.dmp

Filesize
40.1MB

Download
memory/4428-4-0x0000000000400000-0x0000000002C1F000-memory.dmp

Filesize
40.1MB

Download
memory/4428-6-0x0000000002D70000-0x0000000002E70000-memory.dmp

Filesize
1024KB

Download
memory/4428-7-0x0000000002D60000-0x0000000002D6B000-memory.dmp

Filesize
44KB

Download