smokeloader | 86517d5e7b09995ea77fcb76fda669530e537477b2f28774d3d71b29ea67f9ed

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86517d5e7b09995ea77fcb76fda669530e537477b2f28774d3d71b29ea67f9ed.exe
Size

230KB
MD5

9ddf4782a8f83d481dd06043596a4f04
SHA1

13d00c03faf0667519f617c5c6473b12739587a6
SHA256

86517d5e7b09995ea77fcb76fda669530e537477b2f28774d3d71b29ea67f9ed
SHA512

f329c34350d2b41d6d67ed23f7a7cebfb87d8658ad88594f7cafc0553364de3f7808fca3df6afbd47cdc5c412a64a00f99e45214ef1ae86804360cb832ea6e35
SSDEEP

3072:yTZW6jW63hcylXdfsJW++5eagbXs72CxgVBSK3QeRF5pSMoNz3CsJd3UzRPT3Bbe:A6MlkWaLMeFgEoNDCs4zRPT3/

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4144 2648 WerFault.exe 86517d5e7b09995ea77fcb76fda669530e537477b2f28774d3d71b29ea67f9ed.exe

pid	pid_target	process	target process
4144	2648	WerFault.exe	86517d5e7b09995ea77fcb76fda669530e537477b2f28774d3d71b29ea67f9ed.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

86517d5e7b09995ea77fcb76fda669530e537477b2f28774d3d71b29ea67f9ed.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	86517d5e7b09995ea77fcb76fda669530e537477b2f28774d3d71b29ea67f9ed.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	86517d5e7b09995ea77fcb76fda669530e537477b2f28774d3d71b29ea67f9ed.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	86517d5e7b09995ea77fcb76fda669530e537477b2f28774d3d71b29ea67f9ed.exe

C:\Users\Admin\AppData\Local\Temp\86517d5e7b09995ea77fcb76fda669530e537477b2f28774d3d71b29ea67f9ed.exe
"C:\Users\Admin\AppData\Local\Temp\86517d5e7b09995ea77fcb76fda669530e537477b2f28774d3d71b29ea67f9ed.exe"
1⤵
- Checks SCSI registry key(s)
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 376
2⤵
- Program crash
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2648 -ip 2648
1⤵
PID:3176

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2648-1-0x00000000004A0000-0x00000000005A0000-memory.dmp

Filesize
1024KB

Download
memory/2648-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2648-2-0x0000000000610000-0x000000000061B000-memory.dmp

Filesize
44KB

Download
memory/2648-4-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download