smokeloader | de49d9cb1ebe25b12d7a97ddb73fc48b5913270a7643ca3d0bb02a70c96dc9d7

Analysis

max time kernel
146s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
01-05-2024 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de49d9cb1ebe25b12d7a97ddb73fc48b5913270a7643ca3d0bb02a70c96dc9d7.exe
Size

260KB
MD5

c5412fef598ca34cf82d538e239d3462
SHA1

df8f02c2a4d76abeb78ec9d00b0e294441e2301d
SHA256

de49d9cb1ebe25b12d7a97ddb73fc48b5913270a7643ca3d0bb02a70c96dc9d7
SHA512

46773e633e20d6d1e4e4e4f43e0bb594f58392df980fbd4b7a13d26957a76cbbe92284ba535ca48322aff1ea4d49f28ba085faf0fe897bcc6cf3f4536b4bde40
SSDEEP

3072:pKJF77nKmm85Ade66rX4yq5BjXsYsp7g1wd:Qd/qdMrIJjPs+m

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1376 484 WerFault.exe de49d9cb1ebe25b12d7a97ddb73fc48b5913270a7643ca3d0bb02a70c96dc9d7.exe

pid	pid_target	process	target process
1376	484	WerFault.exe	de49d9cb1ebe25b12d7a97ddb73fc48b5913270a7643ca3d0bb02a70c96dc9d7.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

de49d9cb1ebe25b12d7a97ddb73fc48b5913270a7643ca3d0bb02a70c96dc9d7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	de49d9cb1ebe25b12d7a97ddb73fc48b5913270a7643ca3d0bb02a70c96dc9d7.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	de49d9cb1ebe25b12d7a97ddb73fc48b5913270a7643ca3d0bb02a70c96dc9d7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	de49d9cb1ebe25b12d7a97ddb73fc48b5913270a7643ca3d0bb02a70c96dc9d7.exe

C:\Users\Admin\AppData\Local\Temp\de49d9cb1ebe25b12d7a97ddb73fc48b5913270a7643ca3d0bb02a70c96dc9d7.exe
"C:\Users\Admin\AppData\Local\Temp\de49d9cb1ebe25b12d7a97ddb73fc48b5913270a7643ca3d0bb02a70c96dc9d7.exe"
1⤵
- Checks SCSI registry key(s)
PID:484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 384
2⤵
- Program crash
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 484 -ip 484
1⤵
PID:5000

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/484-2-0x0000000002F60000-0x0000000002F6B000-memory.dmp

Filesize
44KB

Download
memory/484-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/484-1-0x0000000002C80000-0x0000000002D80000-memory.dmp

Filesize
1024KB

Download
memory/484-5-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/484-4-0x0000000000400000-0x0000000002AFF000-memory.dmp

Filesize
39.0MB

Download