smokeloader | bf9d4fcc7aeee9158d4764bee8e73b2bb0e42769cbc78e5d4582da43ac0b39a7

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
21-05-2024 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf9d4fcc7aeee9158d4764bee8e73b2bb0e42769cbc78e5d4582da43ac0b39a7.exe
Size

179KB
MD5

ccfb70ac53b63ba7a8a1bb859deb0a63
SHA1

4a6b127768edb4316ecccd722d14cdc0fd67a9c0
SHA256

bf9d4fcc7aeee9158d4764bee8e73b2bb0e42769cbc78e5d4582da43ac0b39a7
SHA512

04f4080063d51b50028399c21b910d645c7ae87b2228170ab9fcc0c4ca6d7d9ec4679d6b0fa1e911d6d2c0f164be4dad565f367cef4c9daf321d4a66fb961326
SSDEEP

1536:D/bI75oFJE7LocP46lfSAPMtyKnM9fGqxHMHKQ0v5WK9IMn4kZhXU4L+vx5tLctB:DYlfSAPM0KMYq2HuWKz4kPU465

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2868 1544 WerFault.exe bf9d4fcc7aeee9158d4764bee8e73b2bb0e42769cbc78e5d4582da43ac0b39a7.exe

pid	pid_target	process	target process
2868	1544	WerFault.exe	bf9d4fcc7aeee9158d4764bee8e73b2bb0e42769cbc78e5d4582da43ac0b39a7.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

bf9d4fcc7aeee9158d4764bee8e73b2bb0e42769cbc78e5d4582da43ac0b39a7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bf9d4fcc7aeee9158d4764bee8e73b2bb0e42769cbc78e5d4582da43ac0b39a7.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bf9d4fcc7aeee9158d4764bee8e73b2bb0e42769cbc78e5d4582da43ac0b39a7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bf9d4fcc7aeee9158d4764bee8e73b2bb0e42769cbc78e5d4582da43ac0b39a7.exe

C:\Users\Admin\AppData\Local\Temp\bf9d4fcc7aeee9158d4764bee8e73b2bb0e42769cbc78e5d4582da43ac0b39a7.exe
"C:\Users\Admin\AppData\Local\Temp\bf9d4fcc7aeee9158d4764bee8e73b2bb0e42769cbc78e5d4582da43ac0b39a7.exe"
1⤵
- Checks SCSI registry key(s)
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 384
2⤵
- Program crash
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1544 -ip 1544
1⤵
PID:4268

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-2-0x0000000004050000-0x000000000405B000-memory.dmp

Filesize
44KB

Download
memory/1544-1-0x0000000002500000-0x0000000002600000-memory.dmp

Filesize
1024KB

Download
memory/1544-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1544-5-0x0000000004050000-0x000000000405B000-memory.dmp

Filesize
44KB

Download
memory/1544-4-0x0000000000400000-0x0000000002349000-memory.dmp

Filesize
31.3MB

Download