smokeloader | 9c9df8669f1b07ec66e7b82ac97e188412f82ce549fb3552cca84413005fec9f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c9df8669f1b07ec66e7b82ac97e188412f82ce549fb3552cca84413005fec9f.exe
Size 37KB
Sample240604-sbc2nsbd79
SHA256 9c9df8669f1b07ec66e7b82ac97e188412f82ce549fb3552cca84413005fec9f
MD5 36da0a1d6f88800b96c2f4cf69ec79d0
SHA1 c1e5c01a230c35931d061caa87cfcf2fa19e933f
SHA512 801ec6d3f032d3bbae7f330ce709bcf5f22654265968e6ded73875fad89eed0323bb789c959aacb34b9267fc4b7c9400de5ad659303819b3bb4443819cd6a128
SSDEEP 768:X3TAscKbB2s4iZ1/NPT3r0JxHWSLzyyiDj78C:HTjb/LhudW80n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9c9df8669f1b07ec66e7b82ac97e188412f82ce549fb3552cca84413005fec9f.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9c9df8669f1b07ec66e7b82ac97e188412f82ce549fb3552cca84413005fec9f.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9c9df8669f1b07ec66e7b82ac97e188412f82ce549fb3552cca84413005fec9f.exe

C:\Users\Admin\AppData\Local\Temp\9c9df8669f1b07ec66e7b82ac97e188412f82ce549fb3552cca84413005fec9f.exe
"C:\Users\Admin\AppData\Local\Temp\9c9df8669f1b07ec66e7b82ac97e188412f82ce549fb3552cca84413005fec9f.exe"
1⤵
- Checks SCSI registry key(s)
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-0-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/744-1-0x0000000000400000-0x000000000040B000-memory.dmp