smokeloader | 12d5c7135c8536fdfa3bbe0dbd012187a49d96ab91cf0cbebd8d15c19638f8d7

Resubmissions

10-07-2024 08:57

240710-kwvs8aybrp 10

10-07-2024 07:01

240710-htl27avhpf 10

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12d5c7135c8536fdfa3bbe0dbd012187a49d96ab91cf0cbebd8d15c19638f8d7.exe
Size

314KB
MD5

a3dfb8d17fccff00dc067a251a751ad0
SHA1

4ef99db632fab658acddd56884a1761ab96d7b1b
SHA256

12d5c7135c8536fdfa3bbe0dbd012187a49d96ab91cf0cbebd8d15c19638f8d7
SHA512

c13a8f4c21d5e9bde4618c1510b1d1443258d28df5d2a7d0df6d57283a92c39e4a178db1a4170b2f4e93c62eb0e19f2efa804b94ce06f697d5e329b0d141320d
SSDEEP

3072:Aa30MOjV1gIoNJS3CpNDU9zyZY8cf7ni66Umwp8JdM:tE/3bCTUhyZonD6UJp8TM

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3584	3312	WerFault.exe	80

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	12d5c7135c8536fdfa3bbe0dbd012187a49d96ab91cf0cbebd8d15c19638f8d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	12d5c7135c8536fdfa3bbe0dbd012187a49d96ab91cf0cbebd8d15c19638f8d7.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	12d5c7135c8536fdfa3bbe0dbd012187a49d96ab91cf0cbebd8d15c19638f8d7.exe

C:\Users\Admin\AppData\Local\Temp\12d5c7135c8536fdfa3bbe0dbd012187a49d96ab91cf0cbebd8d15c19638f8d7.exe
"C:\Users\Admin\AppData\Local\Temp\12d5c7135c8536fdfa3bbe0dbd012187a49d96ab91cf0cbebd8d15c19638f8d7.exe"
1⤵
- Checks SCSI registry key(s)
PID:3312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 464
  2⤵
  - Program crash
  PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3312 -ip 3312
1⤵
PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3312-1-0x0000000002B20000-0x0000000002C20000-memory.dmp

Filesize
1024KB

Download
memory/3312-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3312-2-0x0000000002AE0000-0x0000000002AEB000-memory.dmp

Filesize
44KB

Download
memory/3312-4-0x0000000000400000-0x0000000002836000-memory.dmp

Filesize
36.2MB

Download