smokeloader | 295f0e7a66ddc07476d398e3101ae6d8bbb4ee10c446f1e4f1baea402f0c1eb6

Analysis

max time kernel
90s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
07-05-2024 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

295f0e7a66ddc07476d398e3101ae6d8bbb4ee10c446f1e4f1baea402f0c1eb6.exe
Size

208KB
MD5

93fb95cc6b126feb4d6fc30245039420
SHA1

447357877e00da3726f0c2fa6e73d741945d3384
SHA256

295f0e7a66ddc07476d398e3101ae6d8bbb4ee10c446f1e4f1baea402f0c1eb6
SHA512

2e8c521f0c38b0669e16e199039bd43b7aa5df333e35c62c85734e60753834fade4f122c0a2617427c057b7a1a823fd98a7ae99bef22f22d6fc2cc7d611761f0
SSDEEP

1536:iunajAU5q9j7ykjMY9PdqRKHuf29r+lBpZlfEFrrw1lsRAh/k4615BVOmFRhErmo:iwQY9lqKuei7pgFQ3so/7w5BJFRh2

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1292 3768 WerFault.exe 295f0e7a66ddc07476d398e3101ae6d8bbb4ee10c446f1e4f1baea402f0c1eb6.exe

pid	pid_target	process	target process
1292	3768	WerFault.exe	295f0e7a66ddc07476d398e3101ae6d8bbb4ee10c446f1e4f1baea402f0c1eb6.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

295f0e7a66ddc07476d398e3101ae6d8bbb4ee10c446f1e4f1baea402f0c1eb6.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	295f0e7a66ddc07476d398e3101ae6d8bbb4ee10c446f1e4f1baea402f0c1eb6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	295f0e7a66ddc07476d398e3101ae6d8bbb4ee10c446f1e4f1baea402f0c1eb6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	295f0e7a66ddc07476d398e3101ae6d8bbb4ee10c446f1e4f1baea402f0c1eb6.exe

C:\Users\Admin\AppData\Local\Temp\295f0e7a66ddc07476d398e3101ae6d8bbb4ee10c446f1e4f1baea402f0c1eb6.exe
"C:\Users\Admin\AppData\Local\Temp\295f0e7a66ddc07476d398e3101ae6d8bbb4ee10c446f1e4f1baea402f0c1eb6.exe"
1⤵
- Checks SCSI registry key(s)
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 384
2⤵
- Program crash
PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3768 -ip 3768
1⤵
PID:4844

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3768-1-0x0000000002DD0000-0x0000000002ED0000-memory.dmp

Filesize
1024KB

Download
memory/3768-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3768-2-0x0000000002C40000-0x0000000002C4B000-memory.dmp

Filesize
44KB

Download
memory/3768-4-0x0000000000400000-0x0000000002AF2000-memory.dmp

Filesize
38.9MB

Download