smokeloader | 7b99c632ab84f20275e3e843fea6c977e4b067bbb9793a8ec1fd70dfcd7c0655

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b99c632ab84f20275e3e843fea6c977e4b067bbb9793a8ec1fd70dfcd7c0655.exe
Size

179KB
MD5

9fd9c907502c996750546de517da033f
SHA1

ed4a00b0a408d69434c6b4a06571d43a8bb48fe6
SHA256

7b99c632ab84f20275e3e843fea6c977e4b067bbb9793a8ec1fd70dfcd7c0655
SHA512

285456a65835536e842ab9f79ca0008ac35eb79dfc47abaab78d847403f9a2edfb6bdd1ad322be529979f2140b4c8100b2f585ebfbbf79fc561a170aac81d360
SSDEEP

3072:DZYKT/Hp36WRurj0XDftvjlq50kCzI0+4M:qwvp36frj0Xb7kCzIdX

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3928 4564 WerFault.exe 7b99c632ab84f20275e3e843fea6c977e4b067bbb9793a8ec1fd70dfcd7c0655.exe

pid	pid_target	process	target process
3928	4564	WerFault.exe	7b99c632ab84f20275e3e843fea6c977e4b067bbb9793a8ec1fd70dfcd7c0655.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

7b99c632ab84f20275e3e843fea6c977e4b067bbb9793a8ec1fd70dfcd7c0655.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7b99c632ab84f20275e3e843fea6c977e4b067bbb9793a8ec1fd70dfcd7c0655.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7b99c632ab84f20275e3e843fea6c977e4b067bbb9793a8ec1fd70dfcd7c0655.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7b99c632ab84f20275e3e843fea6c977e4b067bbb9793a8ec1fd70dfcd7c0655.exe

C:\Users\Admin\AppData\Local\Temp\7b99c632ab84f20275e3e843fea6c977e4b067bbb9793a8ec1fd70dfcd7c0655.exe
"C:\Users\Admin\AppData\Local\Temp\7b99c632ab84f20275e3e843fea6c977e4b067bbb9793a8ec1fd70dfcd7c0655.exe"
1⤵
- Checks SCSI registry key(s)
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 352
2⤵
- Program crash
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4564 -ip 4564
1⤵
PID:4184

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4564-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4564-2-0x00000000023E0000-0x00000000023EB000-memory.dmp

Filesize
44KB

Download
memory/4564-1-0x0000000002460000-0x0000000002560000-memory.dmp

Filesize
1024KB

Download
memory/4564-4-0x0000000000400000-0x0000000002349000-memory.dmp

Filesize
31.3MB

Download