smokeloader | f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

Resubmissions

10-05-2024 16:25

240510-tw1h5shh47 10

24-08-2023 11:16

05-08-2023 22:52

24-07-2023 06:25

22-07-2023 15:57

20-07-2023 23:19

20-07-2023 23:06

03-02-2021 11:43

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0di3x.exe
Size

111KB
MD5

bd97f762750d0e38e38d5e8f7363f66a
SHA1

9ae3d7053246289ff908758f9d60d79586f7fc9f
SHA256

d4b767b57f453d599559532d7351feeecd4027b89b0b117552b7a3432ed4a158
SHA512

d0f00c07563aab832b181a7ab93413a93f913f813c83d63c25f4473b7fa2003b4b2a83c97bd9766f9f45a7f2de9e922139a010612f21b15407c9f2bb58a53e39
SSDEEP

1536:4SYTPSLUTRZaEioqsQRPRXplmbH50B+dLDOZrZRzKZvJj5RmLFs8hN:43OLUra1oqxvplQ50BrStJ9RmLFs

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1144
Executes dropped EXE 1 IoCs

Processes:

svjrthg

pid process

1280 svjrthg
Loads dropped DLL 1 IoCs

Processes:

0di3x.exe

pid process

3000 0di3x.exe

pid	process
1144

pid	process
1280	svjrthg

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0di3x.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0di3x.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0di3x.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0di3x.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0di3x.exe

pid	process
3000	0di3x.exe
3000	0di3x.exe
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1144
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

0di3x.exe

pid process

3000 0di3x.exe

pid	process
1144

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1660 wrote to memory of 1280	1660	taskeng.exe	svjrthg
PID 1660 wrote to memory of 1280	1660	taskeng.exe	svjrthg
PID 1660 wrote to memory of 1280	1660	taskeng.exe	svjrthg
PID 1660 wrote to memory of 1280	1660	taskeng.exe	svjrthg

C:\Users\Admin\AppData\Local\Temp\0di3x.exe
"C:\Users\Admin\AppData\Local\Temp\0di3x.exe"
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3000

C:\Windows\system32\taskeng.exe
taskeng.exe {2DD04021-A64B-4D12-957B-3DAA06A56177} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\AppData\Roaming\svjrthg
C:\Users\Admin\AppData\Roaming\svjrthg
2⤵
- Executes dropped EXE
PID:1280

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svjrthg
Filesize
111KB

MD5
bd97f762750d0e38e38d5e8f7363f66a

SHA1
9ae3d7053246289ff908758f9d60d79586f7fc9f

SHA256
d4b767b57f453d599559532d7351feeecd4027b89b0b117552b7a3432ed4a158

SHA512
d0f00c07563aab832b181a7ab93413a93f913f813c83d63c25f4473b7fa2003b4b2a83c97bd9766f9f45a7f2de9e922139a010612f21b15407c9f2bb58a53e39

Download Submit
\Users\Admin\AppData\Local\Temp\2F6.tmp
Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
memory/1144-7-0x0000000002140000-0x0000000002156000-memory.dmp

Filesize
88KB

Download
memory/1280-20-0x0000000000400000-0x0000000002FA6000-memory.dmp

Filesize
43.6MB

Download
memory/1280-19-0x0000000000400000-0x0000000002FA6000-memory.dmp

Filesize
43.6MB

Download
memory/3000-2-0x0000000003050000-0x0000000003150000-memory.dmp

Filesize
1024KB

Download
memory/3000-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3000-3-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/3000-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3000-8-0x0000000000400000-0x0000000002FA6000-memory.dmp

Filesize
43.6MB

Download