smokeloader | add4f5b609f374e7c6f35ce1bcd173a700d9e2d11ca2bc5fcb4ff4bd0a25467d

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
23/07/2024, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
add4f5b609f374e7c6f35ce1bcd173a700d9e2d11ca2bc5fcb4ff4bd0a25467d.exe
Size 152KB
Sample240723-d2n5asvfmg
SHA256 add4f5b609f374e7c6f35ce1bcd173a700d9e2d11ca2bc5fcb4ff4bd0a25467d
MD5 c85a988e54b36e254f0dafa1eded4b75
SHA1 b9f107b9a74944a006aacba67230e0315ba0a21b
SHA512 ba5150f6779a07af3bb569850b76189883bf90ea75b9334863b877f908ffd6ba7116e339ef3541ea720f59e05ba00acfb93cb3402080ee2606660c529387b4e2
SSDEEP 1536:6vfWasMLxDyMVLLKu28P32z6NyaPqACfpW2M6gv8quTPbaxYNAn5I8561ktqBD6l:OPfLv9iPjEHuTxNAn5I8561mqBD6xKs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1556	4940	WerFault.exe	80

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	add4f5b609f374e7c6f35ce1bcd173a700d9e2d11ca2bc5fcb4ff4bd0a25467d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	add4f5b609f374e7c6f35ce1bcd173a700d9e2d11ca2bc5fcb4ff4bd0a25467d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	add4f5b609f374e7c6f35ce1bcd173a700d9e2d11ca2bc5fcb4ff4bd0a25467d.exe

C:\Users\Admin\AppData\Local\Temp\add4f5b609f374e7c6f35ce1bcd173a700d9e2d11ca2bc5fcb4ff4bd0a25467d.exe
"C:\Users\Admin\AppData\Local\Temp\add4f5b609f374e7c6f35ce1bcd173a700d9e2d11ca2bc5fcb4ff4bd0a25467d.exe"
1⤵
- Checks SCSI registry key(s)
PID:4940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 384
  2⤵
  - Program crash
  PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4940 -ip 4940
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4940-3-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4940-2-0x00000000009E0000-0x00000000009EB000-memory.dmp

Download

memory/4940-1-0x00000000004C0000-0x00000000005C0000-memory.dmp

Download

memory/4940-4-0x0000000000400000-0x000000000043A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads