smokeloader | 8f79a923b128ebefd6b246f736dbe2745118442394f1b5a284a49c59a79d6c92

Analysis

max time kernel
133s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31d2245738b8b7b38793b3a8e770ae80_NeikiAnalytics.exe
Size

211KB
MD5

31d2245738b8b7b38793b3a8e770ae80
SHA1

d8f6e10db4111dac83b3ff69096b2fa952882d3a
SHA256

8f79a923b128ebefd6b246f736dbe2745118442394f1b5a284a49c59a79d6c92
SHA512

e3fbe3777ea9f664df6f698d99af1693bda86640f1c5539a78ead906a5ba12eaec375f5ff11b64f163bf72c76e04968e8b3effe8ad7ecd229c17d431cdef1b01
SSDEEP

3072:2s7akQHf4C/RgMhg2Z6+6sSwevGUp6EQ8iUdoWNxb4PltslTqAoe2Ce:tOwC5gh9NpTQ8i1WNZq2lTFoe2

Score

10^/10

smokeloader pub2 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2044 1056 WerFault.exe 31d2245738b8b7b38793b3a8e770ae80_NeikiAnalytics.exe

pid	pid_target	process	target process
2044	1056	WerFault.exe	31d2245738b8b7b38793b3a8e770ae80_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

31d2245738b8b7b38793b3a8e770ae80_NeikiAnalytics.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	31d2245738b8b7b38793b3a8e770ae80_NeikiAnalytics.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	31d2245738b8b7b38793b3a8e770ae80_NeikiAnalytics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	31d2245738b8b7b38793b3a8e770ae80_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\31d2245738b8b7b38793b3a8e770ae80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\31d2245738b8b7b38793b3a8e770ae80_NeikiAnalytics.exe"
1⤵
- Checks SCSI registry key(s)
PID:1056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 352
  2⤵
  - Program crash
  PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1056 -ip 1056
1⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3668,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
1⤵
PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-1-0x0000000002F90000-0x0000000003090000-memory.dmp

Filesize
1024KB

Download
memory/1056-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1056-2-0x0000000002F00000-0x0000000002F0B000-memory.dmp

Filesize
44KB

Download
memory/1056-4-0x0000000000400000-0x0000000002C94000-memory.dmp

Filesize
40.6MB

Download