smokeloader | 68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9

General

Target

68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9.exe
Size

222KB
MD5

bdf4f4c6fd2011a7de032a5b9be5aae9
SHA1

2a3eea3f0f773018f883602bfda21ffd37f28b1e
SHA256

68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9
SHA512

4f72d40e6533c2f656fced65ba190451155b22019862a0fbb91e3069bb104e692a85ba40efb1a3712e46270c20d0ada48330a42e3746d73a917a1369d77c6f69
SSDEEP

3072:vz72zjy9g72urLJsyw7utXmXCExCqd17RhGB5KPHdX5Elx:Oy9glFsyuu8yETZPGmPHbg

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1208
Executes dropped EXE 1 IoCs

Processes:

uihthjc

pid process

1952 uihthjc

pid	process
1208

pid	process
1952	uihthjc

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9.exeuihthjc

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uihthjc
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uihthjc
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uihthjc

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9.exe

pid	process
2040	68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9.exe
2040	68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9.exe
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9.exeuihthjc

pid process

2040 68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9.exe
1952 uihthjc
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 1208

description	pid	process
Token: SeShutdownPrivilege	1208

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2260 wrote to memory of 1952	2260	taskeng.exe	uihthjc
PID 2260 wrote to memory of 1952	2260	taskeng.exe	uihthjc
PID 2260 wrote to memory of 1952	2260	taskeng.exe	uihthjc
PID 2260 wrote to memory of 1952	2260	taskeng.exe	uihthjc

C:\Users\Admin\AppData\Local\Temp\68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9.exe
"C:\Users\Admin\AppData\Local\Temp\68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2040

C:\Windows\system32\taskeng.exe
taskeng.exe {AB29D358-0FAF-445E-B5D6-F534C72888EA} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2260

C:\Users\Admin\AppData\Roaming\uihthjc
C:\Users\Admin\AppData\Roaming\uihthjc
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1952

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\uihthjc
Filesize
222KB

MD5
bdf4f4c6fd2011a7de032a5b9be5aae9

SHA1
2a3eea3f0f773018f883602bfda21ffd37f28b1e

SHA256
68403773e095775f509e4dbf199a54dfce594077cb8195c48de1eb3c26abf2c9

SHA512
4f72d40e6533c2f656fced65ba190451155b22019862a0fbb91e3069bb104e692a85ba40efb1a3712e46270c20d0ada48330a42e3746d73a917a1369d77c6f69

Download Submit
memory/1208-4-0x0000000002620000-0x0000000002636000-memory.dmp

Filesize
88KB

Download
memory/1208-16-0x0000000002D00000-0x0000000002D16000-memory.dmp

Filesize
88KB

Download
memory/1952-15-0x0000000000400000-0x0000000002AF6000-memory.dmp

Filesize
39.0MB

Download
memory/1952-17-0x0000000000400000-0x0000000002AF6000-memory.dmp

Filesize
39.0MB

Download
memory/2040-1-0x0000000002F40000-0x0000000003040000-memory.dmp

Filesize
1024KB

Download
memory/2040-2-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2040-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2040-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2040-5-0x0000000000400000-0x0000000002AF6000-memory.dmp

Filesize
39.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads