smokeloader | fc1d13a97211887dfa7767daa27817c1575834899d9f47a674f81d288230df6e

Analysis

max time kernel
310s
max time network
323s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-04-2024 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc1d13a97211887dfa7767daa27817c1575834899d9f47a674f81d288230df6e.exe
Size

311KB
MD5

919f8f761910803d4fdab592dbbee63c
SHA1

819c861043ea6ba0d69d48a56e1f8a0c295eaf83
SHA256

fc1d13a97211887dfa7767daa27817c1575834899d9f47a674f81d288230df6e
SHA512

69e13430652a6855f9cfa4df964f3bdebadbfc8d405b06330706e7a273a5d06b34836864eda4b792fa46eaef1b7ced10f7c2e024c7f9e09b329938d511d481ee
SSDEEP

3072:kpmcLlzbB0rV5n7CzvfHT99+nPGEl8G2TQVWyS7xAYjhMp70nFXXa6uF4W6vc2m:/qB0772v/T99oVmA370nFXKXF4W602

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

912 2512 WerFault.exe fc1d13a97211887dfa7767daa27817c1575834899d9f47a674f81d288230df6e.exe

pid	pid_target	process	target process
912	2512	WerFault.exe	fc1d13a97211887dfa7767daa27817c1575834899d9f47a674f81d288230df6e.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

fc1d13a97211887dfa7767daa27817c1575834899d9f47a674f81d288230df6e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fc1d13a97211887dfa7767daa27817c1575834899d9f47a674f81d288230df6e.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fc1d13a97211887dfa7767daa27817c1575834899d9f47a674f81d288230df6e.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fc1d13a97211887dfa7767daa27817c1575834899d9f47a674f81d288230df6e.exe

C:\Users\Admin\AppData\Local\Temp\fc1d13a97211887dfa7767daa27817c1575834899d9f47a674f81d288230df6e.exe
"C:\Users\Admin\AppData\Local\Temp\fc1d13a97211887dfa7767daa27817c1575834899d9f47a674f81d288230df6e.exe"
1⤵
- Checks SCSI registry key(s)
PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 500
2⤵
- Program crash
PID:912

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-1-0x0000000003040000-0x0000000003140000-memory.dmp

Filesize
1024KB

Download
memory/2512-2-0x0000000002F70000-0x0000000002F7B000-memory.dmp

Filesize
44KB

Download
memory/2512-3-0x0000000000400000-0x0000000002D2C000-memory.dmp

Filesize
41.2MB

Download
memory/2512-6-0x0000000003040000-0x0000000003140000-memory.dmp

Filesize
1024KB

Download
memory/2512-7-0x0000000002F70000-0x0000000002F7B000-memory.dmp

Filesize
44KB

Download