smokeloader | 207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd

Analysis

max time kernel
134s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe
Size 3.0MB
Sample240525-x2m2saff36
SHA256 207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd
MD5 6d847896c20eb21cf6dc6a924138ef32
SHA1 c254273ecdb71e8d9097f726739036a94dd84a90
SHA512 92074de4057f7519cae0eded975479dce2021088b6560f30be8a673fd79c0db4384ff6c09ae81cdba9b61c34415a839a089f6ef05636215ccaf9fc2400d42bf6
SSDEEP 98304:sfUbPHsTPGQE5rSKvY7FPmCOAJC+v6jJcmDcaS:sfUITl4YthO+Ca6VcmcL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 3 IoCs

pid	Process
4224	207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe
4420	RttHlp.exe
5020	RttHlp.exe

Loads dropped DLL 9 IoCs

pid	Process
4224	207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe
4420	RttHlp.exe
4420	RttHlp.exe
5020	RttHlp.exe
5020	RttHlp.exe
5020	RttHlp.exe
5020	RttHlp.exe
5020	RttHlp.exe
4368	UBA_control.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5020 set thread context of 3180	5020	RttHlp.exe	97
PID 3180 set thread context of 4368	3180	cmd.exe	100

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4420	RttHlp.exe
5020	RttHlp.exe
5020	RttHlp.exe
3180	cmd.exe
3180	cmd.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
5020	RttHlp.exe
3180	cmd.exe
3180	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 4224	3648	207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe	82
PID 3648 wrote to memory of 4224	3648	207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe	82
PID 3648 wrote to memory of 4224	3648	207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe	82
PID 4224 wrote to memory of 4420	4224	207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe	95
PID 4224 wrote to memory of 4420	4224	207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe	95
PID 4224 wrote to memory of 4420	4224	207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe	95
PID 4420 wrote to memory of 5020	4420	RttHlp.exe	96
PID 4420 wrote to memory of 5020	4420	RttHlp.exe	96
PID 4420 wrote to memory of 5020	4420	RttHlp.exe	96
PID 5020 wrote to memory of 3180	5020	RttHlp.exe	97
PID 5020 wrote to memory of 3180	5020	RttHlp.exe	97
PID 5020 wrote to memory of 3180	5020	RttHlp.exe	97
PID 5020 wrote to memory of 3180	5020	RttHlp.exe	97
PID 3180 wrote to memory of 4368	3180	cmd.exe	100
PID 3180 wrote to memory of 4368	3180	cmd.exe	100
PID 3180 wrote to memory of 4368	3180	cmd.exe	100
PID 3180 wrote to memory of 4368	3180	cmd.exe	100
PID 3180 wrote to memory of 4368	3180	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe
"C:\Users\Admin\AppData\Local\Temp\207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\Temp\{7676B2AF-82E6-420D-B6ED-CD2997518A42}\.cr\207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe
  "C:\Windows\Temp\{7676B2AF-82E6-420D-B6ED-CD2997518A42}\.cr\207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe" -burn.filehandle.attached=544 -burn.filehandle.self=556
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\Temp\{746A8311-3DE2-48C6-8D8B-16EB45EE3C71}\.ba\RttHlp.exe
    "C:\Windows\Temp\{746A8311-3DE2-48C6-8D8B-16EB45EE3C71}\.ba\RttHlp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Users\Admin\AppData\Roaming\AgentNotepad_beta\RttHlp.exe
      C:\Users\Admin\AppData\Roaming\AgentNotepad_beta\RttHlp.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\UBA_control.exe
        
        C:\Users\Admin\AppData\Local\Temp\UBA_control.exe
        6⤵
        Loads dropped DLL
        
        PID:4368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

3673e539

Path C:\Users\Admin\AppData\Local\Temp\3673e539
Size 750KB
SHA256 b35fd79eeea0342082a1b05047f7ef1744421b4711517bda0987141712471610
MD5 608acadd21f2df782d7c2b870e909d70
SHA1 37eb6793aa7b9bae9b9db4bc8afe2ba688d2da2e
SHA512 f323cb8d4c52c23ea96fbce3b659962e4bd7bc6fcd0b6c56be1f82335a4708b46df47535b03efcf70937eee40f89c30108d5520d503bd486920f088a4c90ffa4
SSDEEP 12288:eaD9qjroHSnhDv6OVe4KyHrh+VnyB+mOYSEHisyluapnv7b5SUdbQyA:ek9wMshDv6y8ywEBbwsylNHlA
MD5 SHA1 SHA512 SSDEEP

Submit Download

UBA_control.exe

Path C:\Users\Admin\AppData\Local\Temp\UBA_control.exe
Size 301KB
SHA256 c50bffbef786eb689358c63fc0585792d174c5e281499f12035afa1ce2ce19c8
MD5 68cefdfbd2e1a35e8c4f144e37d77a76
SHA1 0a6637d5eb3c958a0136358d0290514c7309af73
SHA512 88d79115a6a0c487bd39a00a202f2467f4e05991da780f29f33cfc1ca53d2c6489104d5fbbe7e70167eb20c958b0322690454aec9ab1776d265ab8c558e971f6
SSDEEP 6144:SemIWncUsq/i4vo6cRwtf/STC47MSzISIJTc6TDRb8:3jccjai4vo6cRb+4QScSI7Bb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Country.dll

Path C:\Windows\Temp\{746A8311-3DE2-48C6-8D8B-16EB45EE3C71}\.ba\Country.dll
Size 268KB
SHA256 9d62de209a15955ac366e251c25afc69b6d420b88fd90522efeaeae72712a4ca
MD5 152d2e72616204365c774410ba243126
SHA1 e1f7edbc74e17a3d2de83273b54f71f36906c05c
SHA512 e60e2c99db99e5839f8825a4db98157d2f20cdc6d4692d031d325d9c230459d14748b466bb7344cdbd724a2fa7bf12dcd157bd1c2645d58490a4e42105f271f9
SSDEEP 6144:YNdDtA3z8AhJHbtMQJ19cpt5+iqo4XdmsmsCSfmR:YNdDtAjvbtMKc/pTWcRsRfk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Windows\Temp\{746A8311-3DE2-48C6-8D8B-16EB45EE3C71}\.ba\Register.dll
Size 1.0MB
SHA256 372b14fce2eb35b264f6d4aeef7987da56d951d3a09ef866cf55ed72763caa12
MD5 40b9628354ef4e6ef3c87934575545f4
SHA1 8fb5da182dea64c842953bf72fc573a74adaa155
SHA512 02b0ea82efbfbe2e7308f86bfbec7a5109f3fe91d42731812d2e46aebedce50aabc565d2da9d3fbcd0f46febbff49c534419d1a91e0c14d5a80f06b74888c641
SSDEEP 24576:k0Rdvjw14ZCWQuTs54Qbz27j7BS2Nv+4BT8+u60:BDZ2zAj7pXT3i
MD5 SHA1 SHA512 SSDEEP

Submit Download

RttHlp.exe

Path C:\Windows\Temp\{746A8311-3DE2-48C6-8D8B-16EB45EE3C71}\.ba\RttHlp.exe
Size 135KB
SHA256 8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473
MD5 a2d70fbab5181a509369d96b682fc641
SHA1 22afcdc180400c4d2b9e5a6db2b8a26bff54dd38
SHA512 219c6e7e88004fad9f4392be9a852c58fc43b7f6900e40370991427f37eaea5c18f48d2954f9479dde8bcb787345f4e292d5620add8224aec4d93d7968820b83
SSDEEP 1536:URLRDTAC1CMoR1CqabJWt7AQFYMGhw1ScCD28v2Vv428fmvxOuw03h9VC:URdV1CMoiqadTQFBGhw1ED28+94hGw
MD5 SHA1 SHA512 SSDEEP

Submit Download

aesthete.tar

Path C:\Windows\Temp\{746A8311-3DE2-48C6-8D8B-16EB45EE3C71}\.ba\aesthete.tar
Size 37KB
SHA256 bf896e89241141126c6e1060287d6ddbbcf4b4eecb0069a158e9260f2a1c8c89
MD5 b6500c7d86f28103ce38a101463935e7
SHA1 caca60dab0231fecfbea90e6bd3b66e6aae147a5
SHA512 fbd25f24a04b5afc19bc8d5e247c90835fb277bc8fd160b2b7bc6b0bc15acc9d5db67d63a6f6a9d2f2a6b89ec10828383bff66997017aed6fe3ee4333e423a5f
SSDEEP 768:dyeMNGo6H2Js4wsTazVj3biNi0LXVZsW85cMvj4H3a1w3KC/3:dMNJzJs4zMVPM97VZsUM8Xcw9v
MD5 SHA1 SHA512 SSDEEP

Submit Download

coronal.html

Path C:\Windows\Temp\{746A8311-3DE2-48C6-8D8B-16EB45EE3C71}\.ba\coronal.html
Size 506KB
SHA256 aa515331c99449c42be52bfd4505dbe0a5fee6937e49e473b1f0c3052f160c51
MD5 70027836924f5aa4475aa017bce9073e
SHA1 eae3b0e38812b09180dda8ae5a1fe02636e42c1a
SHA512 b8cbb2dc42620ee8b9aea0ed87bed068cda19d83786a136ef2b4f716c0ab5fa762e408151d6b606cdaed0f007baf098a6a96d24fa2293acb0900b33d0726aeec
SSDEEP 12288:FZEgVRslBT2S0BY8ANa0oE+ZF61HGFqxBYiiGvDj7I:F/P4TYuVNIZF61HG4x6E7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtl120.bpl

Path C:\Windows\Temp\{746A8311-3DE2-48C6-8D8B-16EB45EE3C71}\.ba\rtl120.bpl
Size 1.1MB
SHA256 69b12de013dea740730d777bcc7cc3ac561d583a2eb6a853524ff03057a430cf
MD5 b96b64ed4307558b37759450672f7143
SHA1 7e2ebae7cc2eb573cb1ed7207544e10f4ae5aec1
SHA512 d1c2663138b1b3c480cc923aab0337e316a4d0e58e2900099f78d4733851c0f3954e1165475361e790124cc9f7e0a5d8067e9f266bc0e3a29527591f2258a3c5
SSDEEP 24576:sOpoNWbA1m6z1hGaMopv3RdaK6IPFf0DtDNUTox0My:OtQZuTtMy
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcl120.bpl

Path C:\Windows\Temp\{746A8311-3DE2-48C6-8D8B-16EB45EE3C71}\.ba\vcl120.bpl
Size 1.9MB
SHA256 572edb7d630e9b03f93bd15135d2ca360176c1232051293663ec5b75c2428aec
MD5 c594d746ff6c99d140b5e8da97f12fd4
SHA1 f21742707c5f3fee776f98641f36bd755e24a7b0
SHA512 33b9902b2cf1154d850779cd012c0285882e158b9d1422c54ea9400ca348686773b6bacb760171060d1a0e620f8ff4a26ecd889dea3c454e8fc5fa59b173832b
SSDEEP 24576:j2gekcIlYas4GaAKBTZTkZbJ7YBRSjr2WLPcgjzTGlyz6F:jRvzfZT3XSmqcOTGc+F
MD5 SHA1 SHA512 SSDEEP

Submit Download

207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe

Path C:\Windows\Temp\{7676B2AF-82E6-420D-B6ED-CD2997518A42}\.cr\207042a4dfd4d096e220b218e4969fc819afecca1dbda192991357896ffd28dd.exe
Size 2.7MB
SHA256 08a3ac79c87241a486bd486c417f336f801515ae196d0d4457c572bffce95086
MD5 51c6396f186485cc5c7b78c0b12c6080
SHA1 b8adf225ef1652010c0b14df9e60810dc2cc5071
SHA512 43fff91d6a3fb6c1a846de9f5e10ee4cff92a8afab4b922c7342edcc09ca766972ec74e384d987bd0b8f76cd3001165c4ce4a25ade7f0c5e2552a5923e088947
SSDEEP 49152:sfU4UjLHqIqTP5kQE44r478DvYn7/MkxWy19ldmMUiOpmJx0+v6jJ1jE1cEXydc:sfUbPHsTPGQE5rSKvY7FPmCOAJC+v6ja
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3180-57-0x0000000074650000-0x00000000747CB000-memory.dmp

Download

memory/3180-55-0x00007FFCC84F0000-0x00007FFCC86E5000-memory.dmp

Download

memory/4368-60-0x00000000733F0000-0x0000000074644000-memory.dmp

Download

memory/4368-61-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4368-69-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4368-66-0x00007FFCC84F0000-0x00007FFCC86E5000-memory.dmp

Download

memory/4420-34-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4420-36-0x0000000050120000-0x000000005030D000-memory.dmp

Download

memory/4420-24-0x00007FFCC84F0000-0x00007FFCC86E5000-memory.dmp

Download

memory/4420-35-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/4420-23-0x0000000073F00000-0x000000007407B000-memory.dmp

Download

memory/5020-47-0x0000000074650000-0x00000000747CB000-memory.dmp

Download

memory/5020-48-0x00007FFCC84F0000-0x00007FFCC86E5000-memory.dmp

Download

memory/5020-49-0x0000000074650000-0x00000000747CB000-memory.dmp

Download