smokeloader | e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca

General

Target

e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
Size

114KB
MD5

0636fd9e7c9ef4c50d4c18127c848161
SHA1

cd62c961e6a537cbbe25922b5c2494da45083848
SHA256

e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca
SHA512

b38779e6045cfd732a9d4d9f2413a105c396f37d8a6e0dfa01fdbcc01c99c886fbc6ae6e0879d5a6fbfb279376abdfc6373c67457ed6fd46621b5e7ddac5e0ff
SSDEEP

3072:UNzPHk9Mpct45TTqKR4hsEaiLez7TXHVh:UhREKu04wZrVh

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2017

C2

http://hellobro.bit/

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\cvujfwdg\\swtdwbhb.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe

Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

2508 explorer.exe
Loads dropped DLL 1 IoCs

Processes:

e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe

pid process

2740 e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 104.168.144.17
Destination IP 185.121.177.177
Destination IP 89.18.27.34
Destination IP 178.63.145.230

pid	process
2508	explorer.exe

description	ioc
Destination IP	104.168.144.17
Destination IP	185.121.177.177
Destination IP	89.18.27.34
Destination IP	178.63.145.230

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe

description	pid	process	target process
PID 2740 set thread context of 2516	2740	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe

pid	process
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exee6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe

pid	process
2740	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exee6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe

description	pid	process	target process
PID 2740 wrote to memory of 2516	2740	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
PID 2740 wrote to memory of 2516	2740	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
PID 2740 wrote to memory of 2516	2740	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
PID 2740 wrote to memory of 2516	2740	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
PID 2740 wrote to memory of 2516	2740	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
PID 2516 wrote to memory of 2508	2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe	explorer.exe
PID 2516 wrote to memory of 2508	2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe	explorer.exe
PID 2516 wrote to memory of 2508	2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe	explorer.exe
PID 2516 wrote to memory of 2508	2516	e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
"C:\Users\Admin\AppData\Local\Temp\e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2740

C:\Users\Admin\AppData\Local\Temp\e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe
"C:\Users\Admin\AppData\Local\Temp\e6516d2911fc3378903b396b1b3ec97ddd497a1e8b974b531b1f140a485d39ca.exe"
2⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2516

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Adds policy Run key to start application
- Deletes itself
PID:2508

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd8D53.tmp\System.dll
Filesize
11KB

MD5
55a26d7800446f1373056064c64c3ce8

SHA1
80256857e9a0a9c8897923b717f3435295a76002

SHA256
904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

SHA512
04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

Download Submit
memory/2508-17-0x0000000000080000-0x000000000008A000-memory.dmp

Filesize
40KB

Download
memory/2508-31-0x0000000000080000-0x000000000008A000-memory.dmp

Filesize
40KB

Download
memory/2508-29-0x0000000000080000-0x000000000008A000-memory.dmp

Filesize
40KB

Download
memory/2508-28-0x0000000000080000-0x000000000008A000-memory.dmp

Filesize
40KB

Download
memory/2508-12-0x0000000000680000-0x0000000000901000-memory.dmp

Filesize
2.5MB

Download
memory/2508-13-0x0000000000680000-0x0000000000901000-memory.dmp

Filesize
2.5MB

Download
memory/2508-14-0x0000000000080000-0x000000000008A000-memory.dmp

Filesize
40KB

Download
memory/2516-9-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2516-19-0x00000000002B0000-0x00000000002BA000-memory.dmp

Filesize
40KB

Download
memory/2516-10-0x00000000002B0000-0x00000000002BA000-memory.dmp

Filesize
40KB

Download
memory/2516-8-0x00000000002B0000-0x00000000002BA000-memory.dmp

Filesize
40KB

Download
memory/2516-7-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads