smokeloader | 0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1

General

Target

file.exe
Size

210KB
MD5

10e9648c3c9c3f6985e5962cdc795f21
SHA1

a23f89036f056b967dfb6d8c8632d4e3d56d2258
SHA256

0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1
SHA512

6c597f9278fce6d03d3aabaace82e2c6dd3afac291b484c525aeb264f9d6a6041d415ca60bac4569ca4dcd605c741f56757323fe3e20dc6978adb703ec158d6f
SSDEEP

1536:W27ZCH13jDoPwbt7KI8tdz8eicURJ70l5Mh/shYBOTR2eENX5lY4h1jSXkJxMA9Q:UBx8iciOe18YEAt5zpBHOmAK

Score

10^/10

smokeloader pub1 backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

Processes:

pid process

3336
Executes dropped EXE 1 IoCs

Processes:

vwihwww

pid process

3268 vwihwww
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

File opened (read-only) \??\D: explorer.exe
File opened (read-only) \??\F: explorer.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

35 drive.google.com
72 drive.google.com
73 drive.google.com

pid	process
3336

pid	process
3268	vwihwww

description	ioc	process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

flow	ioc
35	drive.google.com
72	drive.google.com
73	drive.google.com

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

file.exevwihwww

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vwihwww
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vwihwww
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vwihwww
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Modifies registry class 9 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{24ACAC6C-066D-412E-A88D-93BCD7A0A8EF}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exe

pid	process
2420	file.exe
2420	file.exe
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336
3336

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

file.exevwihwww

pid process

2420 file.exe
3268 vwihwww

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

explorer.exe

description	pid	process
Token: SeShutdownPrivilege	3336
Token: SeCreatePagefilePrivilege	3336
Token: SeShutdownPrivilege	3336
Token: SeCreatePagefilePrivilege	3336
Token: SeShutdownPrivilege	3436	explorer.exe
Token: SeCreatePagefilePrivilege	3436	explorer.exe
Token: SeShutdownPrivilege	3436	explorer.exe
Token: SeCreatePagefilePrivilege	3436	explorer.exe
Token: SeShutdownPrivilege	3436	explorer.exe
Token: SeCreatePagefilePrivilege	3436	explorer.exe
Token: SeShutdownPrivilege	3436	explorer.exe
Token: SeCreatePagefilePrivilege	3436	explorer.exe
Token: SeShutdownPrivilege	3436	explorer.exe
Token: SeCreatePagefilePrivilege	3436	explorer.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

explorer.exe

pid process

3436 explorer.exe
3436 explorer.exe
3436 explorer.exe
3436 explorer.exe
3436 explorer.exe
3436 explorer.exe
3436 explorer.exe

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

explorer.exe

pid	process
3436	explorer.exe
3436	explorer.exe
3436	explorer.exe
3436	explorer.exe
3436	explorer.exe
3436	explorer.exe
3436	explorer.exe
3436	explorer.exe
3436	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 3336 wrote to memory of 820	3336		cmd.exe
PID 3336 wrote to memory of 820	3336		cmd.exe
PID 820 wrote to memory of 548	820	cmd.exe	reg.exe
PID 820 wrote to memory of 548	820	cmd.exe	reg.exe
PID 3336 wrote to memory of 2628	3336		cmd.exe
PID 3336 wrote to memory of 2628	3336		cmd.exe
PID 2628 wrote to memory of 1676	2628	cmd.exe	reg.exe
PID 2628 wrote to memory of 1676	2628	cmd.exe	reg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4B6C.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5D2F.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:1676

C:\Users\Admin\AppData\Roaming\vwihwww
C:\Users\Admin\AppData\Roaming\vwihwww
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:4800

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3436

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:456

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4504

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Filesize
471B

MD5
a9964db630b7c0c6dcaa031a2b57157b

SHA1
baf856fadf461462859fc31618ec81edf7c3165d

SHA256
3f26d8f3599d33ca9880cd8efd7d68142e68e17d56a19c6dcf2ffe4efd0666b1

SHA512
1b4091d40f38931594049e3924608d40a0a1c159a5455c40afca23d1667b19c0764d296c9071644c87aa4aaf247ecc3614807d39e0152b46ebc02c98e51bf9b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Filesize
412B

MD5
c75256a505fa6d8aaef2d86cd4cbf051

SHA1
d4a90e79239912c59adfc28e2a1108ed63a5398b

SHA256
8d434cc38e33981e39cc82ce0b7646924615ddfc34e3f7d5e6c37ff49b786990

SHA512
5a32bba0165bc6b9549e523a86f2d3601941593fe18ac9308d5e440d1f8a671f1f016e47dd6cce28210d82bc04ff386a67d5e91d6de43867eb92d4319366461c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4B6C.bat

Filesize
77B

MD5
55cc761bf3429324e5a0095cab002113

SHA1
2cc1ef4542a4e92d4158ab3978425d517fafd16d

SHA256
d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

SHA512
33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

Download Submit
C:\Users\Admin\AppData\Roaming\vwihwww

Filesize
210KB

MD5
10e9648c3c9c3f6985e5962cdc795f21

SHA1
a23f89036f056b967dfb6d8c8632d4e3d56d2258

SHA256
0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1

SHA512
6c597f9278fce6d03d3aabaace82e2c6dd3afac291b484c525aeb264f9d6a6041d415ca60bac4569ca4dcd605c741f56757323fe3e20dc6978adb703ec158d6f

Download Submit
memory/2420-9-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2420-8-0x00000000024F0000-0x00000000024FB000-memory.dmp

Filesize
44KB

Download
memory/2420-5-0x0000000000400000-0x0000000002350000-memory.dmp

Filesize
31.3MB

Download
memory/2420-1-0x0000000002540000-0x0000000002640000-memory.dmp

Filesize
1024KB

Download
memory/2420-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2420-2-0x00000000024F0000-0x00000000024FB000-memory.dmp

Filesize
44KB

Download
memory/3268-24-0x0000000000400000-0x0000000002350000-memory.dmp

Filesize
31.3MB

Download
memory/3268-25-0x0000000000400000-0x0000000002350000-memory.dmp

Filesize
31.3MB

Download
memory/3268-29-0x0000000000400000-0x0000000002350000-memory.dmp

Filesize
31.3MB

Download
memory/3336-4-0x00000000033E0000-0x00000000033F6000-memory.dmp

Filesize
88KB

Download
memory/3336-26-0x00000000057F0000-0x0000000005806000-memory.dmp

Filesize
88KB

Download
memory/3336-36-0x0000000001560000-0x0000000001561000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads