smokeloader | 83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17

General

Target

83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17.exe
Size

264KB
MD5

81d6cd6bc70a123a732ff29d41c17d6e
SHA1

bb98ec279bb3e7ec5a7750e4581d39a78fff27f7
SHA256

83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17
SHA512

4e3cd438f5649612a82fa4d03dbc2204101aa4f1b8b538d80d60f4a088b34b56108a992e6de89be7a23c1a2b69cad7d8bf7e902767f7384301057aed00636a99
SSDEEP

3072:C1HF1rzpHiwW++HPiXnBdP7yCN4mD0D1eK34dmUzZRUkM/4knlVUPBBu:E9fW0TOAD0DwD/bUkM/4kn/UPB

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1116
Executes dropped EXE 1 IoCs

Processes:

fhjewtw

pid process

648 fhjewtw

pid	process
1116

pid	process
648	fhjewtw

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17.exefhjewtw

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fhjewtw
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fhjewtw
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fhjewtw
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17.exe

pid	process
2220	83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17.exe
2220	83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17.exe
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116
1116

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17.exefhjewtw

pid process

2220 83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17.exe
648 fhjewtw
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 1116
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1116
1116
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1116
1116

description	pid	process
Token: SeShutdownPrivilege	1116

pid	process
1116
1116

pid	process
1116
1116

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2056 wrote to memory of 648	2056	taskeng.exe	fhjewtw
PID 2056 wrote to memory of 648	2056	taskeng.exe	fhjewtw
PID 2056 wrote to memory of 648	2056	taskeng.exe	fhjewtw
PID 2056 wrote to memory of 648	2056	taskeng.exe	fhjewtw

C:\Users\Admin\AppData\Local\Temp\83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17.exe
"C:\Users\Admin\AppData\Local\Temp\83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2220

C:\Windows\system32\taskeng.exe
taskeng.exe {A4A7A1C1-0C89-4D29-936A-C3E30C8B2BD0} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Users\Admin\AppData\Roaming\fhjewtw
C:\Users\Admin\AppData\Roaming\fhjewtw
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\fhjewtw

Filesize
264KB

MD5
81d6cd6bc70a123a732ff29d41c17d6e

SHA1
bb98ec279bb3e7ec5a7750e4581d39a78fff27f7

SHA256
83f7f0fd12bd5cd73459f02b41a1faec93347f7f2eade76aaef584dbc3f18f17

SHA512
4e3cd438f5649612a82fa4d03dbc2204101aa4f1b8b538d80d60f4a088b34b56108a992e6de89be7a23c1a2b69cad7d8bf7e902767f7384301057aed00636a99

Download Submit
memory/648-14-0x0000000000230000-0x0000000000330000-memory.dmp

Filesize
1024KB

Download
memory/648-16-0x0000000000400000-0x0000000004033000-memory.dmp

Filesize
60.2MB

Download
memory/1116-3-0x0000000002DF0000-0x0000000002E06000-memory.dmp

Filesize
88KB

Download
memory/1116-15-0x0000000002E30000-0x0000000002E46000-memory.dmp

Filesize
88KB

Download
memory/2220-1-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/2220-2-0x00000000001B0000-0x00000000001BB000-memory.dmp

Filesize
44KB

Download
memory/2220-7-0x00000000001B0000-0x00000000001BB000-memory.dmp

Filesize
44KB

Download
memory/2220-4-0x0000000000400000-0x0000000004033000-memory.dmp

Filesize
60.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads