smokeloader | ef44c393b607093cbb85fee733531b41f56aa03d56d5fd3d4c60e1c0bd3f51dd

Analysis

max time kernel
146s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
25/06/2024, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef44c393b607093cbb85fee733531b41f56aa03d56d5fd3d4c60e1c0bd3f51dd.exe
Size 322KB
Sample240625-ps7qtstapn
SHA256 ef44c393b607093cbb85fee733531b41f56aa03d56d5fd3d4c60e1c0bd3f51dd
MD5 1bcb9d8ba02bdbe8dcdb08f369228e0b
SHA1 b5e2e532ef2813e0cdbc3e124d7dd90e41495ec0
SHA512 b1892eab7210cdec06d425bce13b7c066cda3863951bbd62f85dd362084c3bd5d35fee428bc46882b8787ae4877f51522665efef79c27e5c7192db9bd5aed298
SSDEEP 3072:cqWLOU/jAxIOG+1o1VFbBFeRC5xat4LtzCX1Ek1EJxTEqS:cBLd/jwFnGNBFau68KNH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	3764	WerFault.exe	77

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ef44c393b607093cbb85fee733531b41f56aa03d56d5fd3d4c60e1c0bd3f51dd.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ef44c393b607093cbb85fee733531b41f56aa03d56d5fd3d4c60e1c0bd3f51dd.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ef44c393b607093cbb85fee733531b41f56aa03d56d5fd3d4c60e1c0bd3f51dd.exe

C:\Users\Admin\AppData\Local\Temp\ef44c393b607093cbb85fee733531b41f56aa03d56d5fd3d4c60e1c0bd3f51dd.exe
"C:\Users\Admin\AppData\Local\Temp\ef44c393b607093cbb85fee733531b41f56aa03d56d5fd3d4c60e1c0bd3f51dd.exe"
1⤵
- Checks SCSI registry key(s)
PID:3764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 408
  2⤵
  - Program crash
  PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3764 -ip 3764
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3764-1-0x0000000002AA0000-0x0000000002BA0000-memory.dmp

Download

memory/3764-3-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3764-2-0x0000000004340000-0x000000000434B000-memory.dmp

Download

memory/3764-4-0x0000000000400000-0x000000000273D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads