smokeloader | 4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3

Analysis

max time kernel
136s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe
Size 2.8MB
Sample240525-1gerfsbc6w
SHA256 4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3
MD5 8f6e195ecad665f4494bdc9764a5bd00
SHA1 3b4b90aa1fa10d13c8ed814b841a57c240e91112
SHA512 2009703a87e594ecd94e2f9366594101501f6ee90662206763bcfe948856f7cd8006f0e46e14376f93868b45d103d7b77a6c7f2f135f919db5d1274353ae5847
SSDEEP 49152:sfU4UjQKuRnxRo3DOAo1SWTb9kAJvLzZTAXXFhv9NGK2Aijo14jdOSxnKoc3DFpD:sfUbUjnxR6ypSDKfKh2/BhJ6DL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 3 IoCs

pid	Process
1912	4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe
5060	RttHlp.exe
3472	RttHlp.exe

Loads dropped DLL 7 IoCs

pid	Process
1912	4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe
5060	RttHlp.exe
5060	RttHlp.exe
3472	RttHlp.exe
3472	RttHlp.exe
3472	RttHlp.exe
3656	UBA_control.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3472 set thread context of 3436	3472	RttHlp.exe	99
PID 3436 set thread context of 3656	3436	cmd.exe	102

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5060	RttHlp.exe
3472	RttHlp.exe
3472	RttHlp.exe
3436	cmd.exe
3436	cmd.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3472	RttHlp.exe
3436	cmd.exe
3436	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1912	848	4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe	82
PID 848 wrote to memory of 1912	848	4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe	82
PID 848 wrote to memory of 1912	848	4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe	82
PID 1912 wrote to memory of 5060	1912	4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe	97
PID 1912 wrote to memory of 5060	1912	4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe	97
PID 1912 wrote to memory of 5060	1912	4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe	97
PID 5060 wrote to memory of 3472	5060	RttHlp.exe	98
PID 5060 wrote to memory of 3472	5060	RttHlp.exe	98
PID 5060 wrote to memory of 3472	5060	RttHlp.exe	98
PID 3472 wrote to memory of 3436	3472	RttHlp.exe	99
PID 3472 wrote to memory of 3436	3472	RttHlp.exe	99
PID 3472 wrote to memory of 3436	3472	RttHlp.exe	99
PID 3472 wrote to memory of 3436	3472	RttHlp.exe	99
PID 3436 wrote to memory of 3656	3436	cmd.exe	102
PID 3436 wrote to memory of 3656	3436	cmd.exe	102
PID 3436 wrote to memory of 3656	3436	cmd.exe	102
PID 3436 wrote to memory of 3656	3436	cmd.exe	102
PID 3436 wrote to memory of 3656	3436	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe
"C:\Users\Admin\AppData\Local\Temp\4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\Temp\{2ABB1082-F2F1-464D-BC02-3885A90DCF47}\.cr\4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe
  "C:\Windows\Temp\{2ABB1082-F2F1-464D-BC02-3885A90DCF47}\.cr\4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe" -burn.filehandle.attached=532 -burn.filehandle.self=540
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\Temp\{FADD520F-BB9C-41CD-8304-17E81EE37FB4}\.ba\RttHlp.exe
    "C:\Windows\Temp\{FADD520F-BB9C-41CD-8304-17E81EE37FB4}\.ba\RttHlp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Users\Admin\AppData\Roaming\clientPatchCEH_dbg\RttHlp.exe
      C:\Users\Admin\AppData\Roaming\clientPatchCEH_dbg\RttHlp.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3472
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\UBA_control.exe
        
        C:\Users\Admin\AppData\Local\Temp\UBA_control.exe
        6⤵
        Loads dropped DLL
        
        PID:3656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

3b2c5d8b

Path C:\Users\Admin\AppData\Local\Temp\3b2c5d8b
Size 750KB
SHA256 abf87ca2adc982c4bcfb96f04cfc9f68564c9b62b27697c7afa9b38e78264da9
MD5 841fc0df248bfd8fd96f43dcf20a8ae0
SHA1 03b0db4734b1b28bb561f02eb3a8161f673be59a
SHA512 0330933a37b7fd81335d07b39ca008267529d10a7a027ea28b06db540fd2425972030322e6fcc8e64c0344b118c525ceb04449d2df5fb9598e55edd458e3f07e
SSDEEP 12288:JZqzekTDC9zqLPjsSByWSZ0Wsdq3NUmma32VKetsQuVTUmxiF6MBwKeoyeFIInxL:JZq5TCzqLPjGr0WsdqNUmHmvtiTVzoyC
MD5 SHA1 SHA512 SSDEEP

Submit Download

UBA_control.exe

Path C:\Users\Admin\AppData\Local\Temp\UBA_control.exe
Size 301KB
SHA256 c50bffbef786eb689358c63fc0585792d174c5e281499f12035afa1ce2ce19c8
MD5 68cefdfbd2e1a35e8c4f144e37d77a76
SHA1 0a6637d5eb3c958a0136358d0290514c7309af73
SHA512 88d79115a6a0c487bd39a00a202f2467f4e05991da780f29f33cfc1ca53d2c6489104d5fbbe7e70167eb20c958b0322690454aec9ab1776d265ab8c558e971f6
SSDEEP 6144:SemIWncUsq/i4vo6cRwtf/STC47MSzISIJTc6TDRb8:3jccjai4vo6cRb+4QScSI7Bb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe

Path C:\Windows\Temp\{2ABB1082-F2F1-464D-BC02-3885A90DCF47}\.cr\4af9effb5d72471e07b7881eb59ed41f81d3ac54f4579789acfff385d8b8a5c3.exe
Size 2.7MB
SHA256 cd981a91c27326d26f31094dd6fd2c4b3efb50028a180eeb484802e2a77943c0
MD5 4e205af58f4d45dfdd206b2568c17e91
SHA1 fbedd870c132607295faa5b1f00d40fd25694e71
SHA512 be76960dae136c010028df28cb4bdb7e018a4e6032dc217784add39cd95ee97be5b9f761d520306076de174a9fee0e1d7a1c6f73b74f92441b74f6c4fe6838ba
SSDEEP 49152:sfU4UjQKuRnxRo3DOAo1SWTb9kAJvLzZTAXXFhv9NGK2Aijo14jdOSxnKoc3DFe:sfUbUjnxR6ypSDKfKh2/BhJ6Ds
MD5 SHA1 SHA512 SSDEEP

Submit Download

Deuteranopia.dll

Path C:\Windows\Temp\{FADD520F-BB9C-41CD-8304-17E81EE37FB4}\.ba\Deuteranopia.dll
Size 217KB
SHA256 58d34a42ad20bd435b4db3c4683ead6ae7187ad3ba4765c0904478b3f4ec39e2
MD5 5f9acfe4e54ecba7893870d17323b039
SHA1 5f8fa5f10bd5a423d7466e1402795509011254df
SHA512 1416d08935fb01435d789434f16d6a90b2faac7b3e68c6b780bc84abc2a22fb2d3516e4ec9063471b03bb5dcc72f670afa24def90f9b35937cd756bba3db5d22
SSDEEP 3072:lWNA/h4sZplnVKcMkbsH+1TC00yw8nrYdUa2zz3MZ4/HIyeHQ2gzciEwQqH9m:lWNhshVKaAIT704rYCAKHIyeHfgzcY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Windows\Temp\{FADD520F-BB9C-41CD-8304-17E81EE37FB4}\.ba\Register.dll
Size 1.0MB
SHA256 372b14fce2eb35b264f6d4aeef7987da56d951d3a09ef866cf55ed72763caa12
MD5 40b9628354ef4e6ef3c87934575545f4
SHA1 8fb5da182dea64c842953bf72fc573a74adaa155
SHA512 02b0ea82efbfbe2e7308f86bfbec7a5109f3fe91d42731812d2e46aebedce50aabc565d2da9d3fbcd0f46febbff49c534419d1a91e0c14d5a80f06b74888c641
SSDEEP 24576:k0Rdvjw14ZCWQuTs54Qbz27j7BS2Nv+4BT8+u60:BDZ2zAj7pXT3i
MD5 SHA1 SHA512 SSDEEP

Submit Download

RttHlp.exe

Path C:\Windows\Temp\{FADD520F-BB9C-41CD-8304-17E81EE37FB4}\.ba\RttHlp.exe
Size 135KB
SHA256 8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473
MD5 a2d70fbab5181a509369d96b682fc641
SHA1 22afcdc180400c4d2b9e5a6db2b8a26bff54dd38
SHA512 219c6e7e88004fad9f4392be9a852c58fc43b7f6900e40370991427f37eaea5c18f48d2954f9479dde8bcb787345f4e292d5620add8224aec4d93d7968820b83
SSDEEP 1536:URLRDTAC1CMoR1CqabJWt7AQFYMGhw1ScCD28v2Vv428fmvxOuw03h9VC:URdV1CMoiqadTQFBGhw1ED28+94hGw
MD5 SHA1 SHA512 SSDEEP

Submit Download

aesthete.tar

Path C:\Windows\Temp\{FADD520F-BB9C-41CD-8304-17E81EE37FB4}\.ba\aesthete.tar
Size 37KB
SHA256 bf896e89241141126c6e1060287d6ddbbcf4b4eecb0069a158e9260f2a1c8c89
MD5 b6500c7d86f28103ce38a101463935e7
SHA1 caca60dab0231fecfbea90e6bd3b66e6aae147a5
SHA512 fbd25f24a04b5afc19bc8d5e247c90835fb277bc8fd160b2b7bc6b0bc15acc9d5db67d63a6f6a9d2f2a6b89ec10828383bff66997017aed6fe3ee4333e423a5f
SSDEEP 768:dyeMNGo6H2Js4wsTazVj3biNi0LXVZsW85cMvj4H3a1w3KC/3:dMNJzJs4zMVPM97VZsUM8Xcw9v
MD5 SHA1 SHA512 SSDEEP

Submit Download

coronal.html

Path C:\Windows\Temp\{FADD520F-BB9C-41CD-8304-17E81EE37FB4}\.ba\coronal.html
Size 506KB
SHA256 45c96113ebb1d7e1d656c11dabb8e0cddf7e1d156925ec2831fbb17a816b60c9
MD5 8d6e2e211b07f4a5fd7136e7c95c2649
SHA1 ae6bf2ed7103267722114729727a0630e9c681f0
SHA512 a4e3ad3592c2a3e951a23c4934a80c73015d03b3107f7120c5746e6baa91c8771b45f209f733d20e7f27931b9b0420e342d2770f5955b083fa76d45dd5c243db
SSDEEP 6144:n/yuAc0lzvDK4PCNrkN5Y2/IpdzmyBwboeXFL5x98WcbKbvACRUOUCR0mf+dUgF7:n/cnMU+2wjsbDF7cKACyOOagV8xN898g
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtl120.bpl

Path C:\Windows\Temp\{FADD520F-BB9C-41CD-8304-17E81EE37FB4}\.ba\rtl120.bpl
Size 1.1MB
SHA256 69b12de013dea740730d777bcc7cc3ac561d583a2eb6a853524ff03057a430cf
MD5 b96b64ed4307558b37759450672f7143
SHA1 7e2ebae7cc2eb573cb1ed7207544e10f4ae5aec1
SHA512 d1c2663138b1b3c480cc923aab0337e316a4d0e58e2900099f78d4733851c0f3954e1165475361e790124cc9f7e0a5d8067e9f266bc0e3a29527591f2258a3c5
SSDEEP 24576:sOpoNWbA1m6z1hGaMopv3RdaK6IPFf0DtDNUTox0My:OtQZuTtMy
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcl120.bpl

Path C:\Windows\Temp\{FADD520F-BB9C-41CD-8304-17E81EE37FB4}\.ba\vcl120.bpl
Size 1.9MB
SHA256 572edb7d630e9b03f93bd15135d2ca360176c1232051293663ec5b75c2428aec
MD5 c594d746ff6c99d140b5e8da97f12fd4
SHA1 f21742707c5f3fee776f98641f36bd755e24a7b0
SHA512 33b9902b2cf1154d850779cd012c0285882e158b9d1422c54ea9400ca348686773b6bacb760171060d1a0e620f8ff4a26ecd889dea3c454e8fc5fa59b173832b
SSDEEP 24576:j2gekcIlYas4GaAKBTZTkZbJ7YBRSjr2WLPcgjzTGlyz6F:jRvzfZT3XSmqcOTGc+F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1912-14-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3436-59-0x0000000075A00000-0x0000000075B7B000-memory.dmp

Download

memory/3436-57-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmp

Download

memory/3472-54-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/3472-49-0x0000000075A00000-0x0000000075B7B000-memory.dmp

Download

memory/3472-50-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmp

Download

memory/3472-51-0x0000000075A00000-0x0000000075B7B000-memory.dmp

Download

memory/3472-55-0x0000000050120000-0x000000005030D000-memory.dmp

Download

memory/3656-63-0x00000000744C0000-0x0000000075714000-memory.dmp

Download

memory/3656-62-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3656-71-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3656-68-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmp

Download

memory/5060-37-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/5060-36-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5060-27-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmp

Download

memory/5060-39-0x0000000050120000-0x000000005030D000-memory.dmp

Download

memory/5060-25-0x0000000074370000-0x00000000744EB000-memory.dmp

Download