smokeloader | 9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840

General

Target

9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exe
Size

248KB
MD5

b77043673df8b86cdb3f3049fa4b5cdf
SHA1

998b7f59bf0acd24f920c5608422b59a1f610d80
SHA256

9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840
SHA512

63ab9f4b5108571d094189a6536be0e218e9296c60285d5d2e21f8f799e70421ec44988e94d73b6e7cf2b8020d8e39cd8b3b49c3d599ec8eca4d65280b81a712
SSDEEP

3072:/rwPX0z03zXLpLwAafrPH87QBLAKHIrzJ1fiXMOS5i8nF53JBLGCH:u9XLvafr/87QBEKHazrfi/4ba

Score

10^/10

smokeloader pub1 aspackv2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\zyNGhf.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

zyNGhf.exe

pid process

2636 zyNGhf.exe

pid	process
2636	zyNGhf.exe

Loads dropped DLL 2 IoCs

Processes:

9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exe

pid	process
3024	9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exe
3024	9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exe

Drops file in Program Files directory 64 IoCs

Processes:

zyNGhf.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	zyNGhf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Windows Journal\PDIALOG.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\Hearts.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	zyNGhf.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Windows Defender\MpCmdRun.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	zyNGhf.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE	zyNGhf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	zyNGhf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	zyNGhf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	zyNGhf.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\WinMail.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	zyNGhf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	zyNGhf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

zyNGhf.execmd.exe9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zyNGhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exezyNGhf.exe

description	pid	process	target process
PID 3024 wrote to memory of 2636	3024	9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exe	zyNGhf.exe
PID 3024 wrote to memory of 2636	3024	9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exe	zyNGhf.exe
PID 3024 wrote to memory of 2636	3024	9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exe	zyNGhf.exe
PID 3024 wrote to memory of 2636	3024	9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exe	zyNGhf.exe
PID 2636 wrote to memory of 2580	2636	zyNGhf.exe	cmd.exe
PID 2636 wrote to memory of 2580	2636	zyNGhf.exe	cmd.exe
PID 2636 wrote to memory of 2580	2636	zyNGhf.exe	cmd.exe
PID 2636 wrote to memory of 2580	2636	zyNGhf.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exe
"C:\Users\Admin\AppData\Local\Temp\9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024

C:\Users\Admin\AppData\Local\Temp\zyNGhf.exe
C:\Users\Admin\AppData\Local\Temp\zyNGhf.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\44c83afb.bat" "
3⤵
- System Location Discovery: System Language Discovery
PID:2580

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0E1IWGZ4\k2[1].rar
Filesize
4B

MD5
d3b07384d113edec49eaa6238ad5ff00

SHA1
f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

SHA256
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

SHA512
0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1FEE663D.exe
Filesize
4B

MD5
20879c987e2f9a916e578386d499f629

SHA1
c7b33ddcc42361fdb847036fc07e880b81935d5d

SHA256
9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

SHA512
bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

Download Submit
C:\Users\Admin\AppData\Local\Temp\44c83afb.bat
Filesize
187B

MD5
dd2068a0cb1a5e011e40f8a80990b93c

SHA1
00249e879ca4fedd2bd1608f502c65b8d9ab974f

SHA256
5951908259d66bebe944c3a512bbd9a15a2e6ed80a796e6b99dc86cb74c53fc9

SHA512
10e9648b66f52b5db4c2fb02c64c928881a1a2fcc3586bc4af477a6468bc5461758ef24a5d1f825f72c19dee4bd4918ffd03be8869e9fb2ccaecfe54e867f9b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zyNGhf.exe
Filesize
15KB

MD5
f7d21de5c4e81341eccd280c11ddcc9a

SHA1
d4e9ef10d7685d491583c6fa93ae5d9105d815bd

SHA256
4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794

SHA512
e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

Download Submit
memory/2636-11-0x0000000001100000-0x0000000001109000-memory.dmp

Filesize
36KB

Download
memory/2636-61-0x0000000001100000-0x0000000001109000-memory.dmp

Filesize
36KB

Download
memory/3024-20-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/3024-19-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/3024-18-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3024-17-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/3024-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3024-16-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3024-9-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/3024-10-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads