smokeloader | 02cacf524527064e447c85bef406a6e5125d06b69bd35e10a813bf4a5659b985

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f318080c6c0aef583c575f49bd61e9b4e8b6784f4c52b512e9c07090e4cedea.exe
Size

2.3MB
MD5

665d982ca7f55392948abb118b2c6b3d
SHA1

76b7c096dae1f20041e7e55e3d863ec35cb4fd2d
SHA256

5f318080c6c0aef583c575f49bd61e9b4e8b6784f4c52b512e9c07090e4cedea
SHA512

8f7d99ef72b0fff0c0a758f28a948b9c4c2387f5e9a9b7f0ac3a8971d963d457d58cbd8368bc55809196c21daea956dc1a6eba664efa2b91567057ad22a19723
SSDEEP

49152:tsOzsGwNJp72gr0XQZ/8VM+giH+pmGj1DrGpc85Rwxh:9fwnEg4hVvNCm6GpR5Rw

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 2 IoCs

pid	Process
4484	2mP7389.exe
3128	5qy6iJ1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5f318080c6c0aef583c575f49bd61e9b4e8b6784f4c52b512e9c07090e4cedea.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5qy6iJ1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5qy6iJ1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5qy6iJ1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	2mP7389.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 4484	2636	5f318080c6c0aef583c575f49bd61e9b4e8b6784f4c52b512e9c07090e4cedea.exe	82
PID 2636 wrote to memory of 4484	2636	5f318080c6c0aef583c575f49bd61e9b4e8b6784f4c52b512e9c07090e4cedea.exe	82
PID 2636 wrote to memory of 4484	2636	5f318080c6c0aef583c575f49bd61e9b4e8b6784f4c52b512e9c07090e4cedea.exe	82
PID 2636 wrote to memory of 3128	2636	5f318080c6c0aef583c575f49bd61e9b4e8b6784f4c52b512e9c07090e4cedea.exe	96
PID 2636 wrote to memory of 3128	2636	5f318080c6c0aef583c575f49bd61e9b4e8b6784f4c52b512e9c07090e4cedea.exe	96
PID 2636 wrote to memory of 3128	2636	5f318080c6c0aef583c575f49bd61e9b4e8b6784f4c52b512e9c07090e4cedea.exe	96

C:\Users\Admin\AppData\Local\Temp\5f318080c6c0aef583c575f49bd61e9b4e8b6784f4c52b512e9c07090e4cedea.exe
"C:\Users\Admin\AppData\Local\Temp\5f318080c6c0aef583c575f49bd61e9b4e8b6784f4c52b512e9c07090e4cedea.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2mP7389.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2mP7389.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4484
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5qy6iJ1.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5qy6iJ1.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2mP7389.exe

Filesize
3.2MB

MD5
b4e9b48f2882fa518797b2d69f2faaf4

SHA1
0f428f7939bec2446ec26474e7d8192440c1fd4c

SHA256
284effd5d250c1d301fef647dc72eaaa87500b3439a9b5b3233738791d51f78d

SHA512
99ba19388d8efb4a5afe2084f8e1f58c1cc805044ad9752cd5435ced2f70849b153974e71b9eaafcbcba88d958959d9f1d347f0c35645f4638288f833641ef6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5qy6iJ1.exe

Filesize
36KB

MD5
1276d91cd5a4797ce3c8c16330d1ad20

SHA1
cdc3ac3606ac6e2fbf11f853e70adcc4c4fe5370

SHA256
3b4dce446671afb5059f0ffc8b468c8ed84c672d525c4748b237f643d8667ee3

SHA512
5241c621af7211c81ba0a66b8eaa373a015efcd390cef74d4f24b789785159a1154503e529387f003b0d7ea87a9b3e5a8c5de62292e4e1dd4b26c856e8e389f2

Download Submit
memory/3128-22-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3128-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4484-12-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/4484-11-0x00000000055F0000-0x00000000055FA000-memory.dmp

Filesize
40KB

Download
memory/4484-10-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/4484-13-0x0000000006850000-0x0000000006A04000-memory.dmp

Filesize
1.7MB

Download
memory/4484-14-0x000000007417E000-0x000000007417F000-memory.dmp

Filesize
4KB

Download
memory/4484-15-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/4484-17-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/4484-9-0x00000000059D0000-0x0000000005F74000-memory.dmp

Filesize
5.6MB

Download
memory/4484-8-0x0000000000910000-0x0000000000C4C000-memory.dmp

Filesize
3.2MB

Download
memory/4484-7-0x000000007417E000-0x000000007417F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads