smokeloader | 538af0e39f24f16e4e52cad03295a359304d8f458c1fe18d0681e884112f2185

Analysis

max time kernel
135s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
538af0e39f24f16e4e52cad03295a359304d8f458c1fe18d0681e884112f2185.exe
Size 693KB
Sample240724-vb9rrawhkr
SHA256 538af0e39f24f16e4e52cad03295a359304d8f458c1fe18d0681e884112f2185
MD5 83741bbca9631aa4925203fbddc0ad7d
SHA1 f636ef4f3279cd49d1036a70293f8390ecc96a3e
SHA512 55ee1b215e46024c3bb3722518d476be148c3c48d60d744c53fecba48b7a02ba9ab2f58b436b9657e4748d72d6696bc5e6f477f7805f91fa66841debd00b9a5b
SSDEEP 12288:tXBffJMAUAyQAg8Y3ElBvCm5KUwzq2uE2na367joJqTOX7gXX7:tXBfmPQXMqm5wzq2uDa367joJqaXQ7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3588 created 3440	3588	Labs.pif	56

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	538af0e39f24f16e4e52cad03295a359304d8f458c1fe18d0681e884112f2185.exe

Executes dropped EXE 2 IoCs

pid	Process
3588	Labs.pif
344	Labs.pif

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
208	tasklist.exe
2740	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3588 set thread context of 344	3588	Labs.pif	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Labs.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	538af0e39f24f16e4e52cad03295a359304d8f458c1fe18d0681e884112f2185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1000	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Labs.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Labs.pif
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Labs.pif

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1000	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3588	Labs.pif
3588	Labs.pif
3588	Labs.pif
3588	Labs.pif
3588	Labs.pif
3588	Labs.pif
3588	Labs.pif
3588	Labs.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	208	tasklist.exe
Token: SeDebugPrivilege	2740	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3588	Labs.pif
3588	Labs.pif
3588	Labs.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3588	Labs.pif
3588	Labs.pif
3588	Labs.pif

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1964	2792	538af0e39f24f16e4e52cad03295a359304d8f458c1fe18d0681e884112f2185.exe	87
PID 2792 wrote to memory of 1964	2792	538af0e39f24f16e4e52cad03295a359304d8f458c1fe18d0681e884112f2185.exe	87
PID 2792 wrote to memory of 1964	2792	538af0e39f24f16e4e52cad03295a359304d8f458c1fe18d0681e884112f2185.exe	87
PID 1964 wrote to memory of 208	1964	cmd.exe	89
PID 1964 wrote to memory of 208	1964	cmd.exe	89
PID 1964 wrote to memory of 208	1964	cmd.exe	89
PID 1964 wrote to memory of 768	1964	cmd.exe	90
PID 1964 wrote to memory of 768	1964	cmd.exe	90
PID 1964 wrote to memory of 768	1964	cmd.exe	90
PID 1964 wrote to memory of 2740	1964	cmd.exe	94
PID 1964 wrote to memory of 2740	1964	cmd.exe	94
PID 1964 wrote to memory of 2740	1964	cmd.exe	94
PID 1964 wrote to memory of 2684	1964	cmd.exe	95
PID 1964 wrote to memory of 2684	1964	cmd.exe	95
PID 1964 wrote to memory of 2684	1964	cmd.exe	95
PID 1964 wrote to memory of 4244	1964	cmd.exe	96
PID 1964 wrote to memory of 4244	1964	cmd.exe	96
PID 1964 wrote to memory of 4244	1964	cmd.exe	96
PID 1964 wrote to memory of 4684	1964	cmd.exe	97
PID 1964 wrote to memory of 4684	1964	cmd.exe	97
PID 1964 wrote to memory of 4684	1964	cmd.exe	97
PID 1964 wrote to memory of 1632	1964	cmd.exe	98
PID 1964 wrote to memory of 1632	1964	cmd.exe	98
PID 1964 wrote to memory of 1632	1964	cmd.exe	98
PID 1964 wrote to memory of 3588	1964	cmd.exe	99
PID 1964 wrote to memory of 3588	1964	cmd.exe	99
PID 1964 wrote to memory of 3588	1964	cmd.exe	99
PID 1964 wrote to memory of 1000	1964	cmd.exe	100
PID 1964 wrote to memory of 1000	1964	cmd.exe	100
PID 1964 wrote to memory of 1000	1964	cmd.exe	100
PID 3588 wrote to memory of 344	3588	Labs.pif	105
PID 3588 wrote to memory of 344	3588	Labs.pif	105
PID 3588 wrote to memory of 344	3588	Labs.pif	105
PID 3588 wrote to memory of 344	3588	Labs.pif	105
PID 3588 wrote to memory of 344	3588	Labs.pif	105

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3440
- C:\Users\Admin\AppData\Local\Temp\538af0e39f24f16e4e52cad03295a359304d8f458c1fe18d0681e884112f2185.exe
  "C:\Users\Admin\AppData\Local\Temp\538af0e39f24f16e4e52cad03295a359304d8f458c1fe18d0681e884112f2185.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Origins Origins.cmd & Origins.cmd & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:208
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:768
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2740
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2684
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 55121725
      4⤵
      System Location Discovery: System Language Discovery
      PID:4244
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "SlutSteLouisTranslation" Cyprus
      4⤵
      System Location Discovery: System Language Discovery
      PID:4684
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Breeding + Fuji + Weather 55121725\s
      4⤵
      System Location Discovery: System Language Discovery
      PID:1632
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\55121725\Labs.pif
      55121725\Labs.pif 55121725\s
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3588
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1000
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\55121725\Labs.pif
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\55121725\Labs.pif
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Labs.pif

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\55121725\Labs.pif
Size 872KB
SHA256 865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4
MD5 6ee7ddebff0a2b78c7ac30f6e00d1d11
SHA1 f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2
SHA512 57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0
SSDEEP 12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\55121725\s
Size 242KB
SHA256 19e0ed3240d70f9ac0602c8507cdcb12b448d8f4aea26f5f0a6913f9517f1a3f
MD5 832180873e27da9b7a218ec02099691a
SHA1 09a26d9ac5619df11650bf11e41c5dd96ea371d2
SHA512 2abe2fd0d9e423b75d1d49d28711402c12c20ba7a88aa0c5360ddded3bac92f7f07b4fca874232e8f8c108427f3264e179a1a2f6f96f79aab1f8f07736f92ab6
SSDEEP 6144:WSeX99XQ0r/PxScf6HaUAisqIbX13nYOh+dtIyV0krz:WSebQuJRNGs1X13YAJwz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Advocacy

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Advocacy
Size 40KB
SHA256 4b0c83524efd0db079aba2519aaf676b784207ac84a7de69918e56c698d81a91
MD5 3e0a5939f55f64dc128ec03642f09392
SHA1 74fc5265b92bf9b807e023e968f94528904918e6
SHA512 ea6eb18fb83dfb46c5461e518a33e4a2279c803931e13fd5dd9d962eb4af35637c2011708b32f1d0457798bdad40f59dfb35ee770aa472cab2ef4901eddb0082
SSDEEP 768:KGE0psu0nM8+aZKINulI1+lRKw4sWGuv6crP:K90psu0nMOKzlvlao/g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Breeding

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Breeding
Size 75KB
SHA256 7c8734f0a4571438a469037571f7ad8a7513e779fd65f3d547d1426bad7b2034
MD5 3ec78865d37dba4270b52656bfcd5d51
SHA1 761877d874e583014bfe9c5f0d5ba71ba4f788a6
SHA512 cb7cafaa16c342f9d5e4a3c9bcebe32b1b2106ad811132be75a4c9f9222fea9ddc5ba5fb0c9cef6626c01e81215f550c060e4300e9d64d83065e806b783e80c5
SSDEEP 1536:R8Rge2XmA1AAWokgUnPFc3QCLuOexdViaMtI1F+hrMdeombucP:WSe211AjpnPFdC6p7VDfbQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cyprus

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cyprus
Size 210B
SHA256 10d22d0f44bcdf23a31d0097069e1d095a86e2113580bfc61f50b7ac3218a4d2
MD5 e5ecf7084f37757a977cb7854faf0dd2
SHA1 6778ea5ac5ecc59171883c2aa7204373f46c5fb1
SHA512 7f4eef0637c68154be4341c02da291e8b81e64ecd7ed5cba5d30a2e1a2e63839c1682fdade36a9da06124321aec610efaf23b4b5fcdd1bf4c6be104e7c0d9ceb
MD5 SHA1 SHA512

Submit Download

Folk

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Folk
Size 121KB
SHA256 da879d5eb37e5c0ef62422b95adb8aa39607bb6c6d1efa817cb8353633b8d0eb
MD5 00425db818e6fd2f0eeb0cf37469b749
SHA1 d9bd6e0afca273aa8a931360c2f91c0d9d1463a1
SHA512 9b8d7aa19308b7376b4933e09613bac281d0ab332bce661b7e590f6568519c66a6d307883b3274e6668ad61b4ee52e519d8a574f6202ad827b9f0a2aa8366721
SSDEEP 1536:TCV21YEsmnq7Cv/+/Coc5m+4Xf8O46895LmNpRGDox2S3hPt8gNpkU5uG3xYwBMN:TCV26MqgQTc5F446iYNpK5SB7BJBzS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fuji

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Fuji
Size 60KB
SHA256 2f64e2c562e065ae15a95be85d128e6f99f6d201b3b18a8cf5dbb1ab8cb87d62
MD5 901f468eeda506282d7906687c36ef22
SHA1 0fb000fa798d648c1309cc6599692ed6ac4d4990
SHA512 17b4768ce6075ea83b774cf37bc2c2f2b7f6b78156c883cb6fa38422513fd8e19e03556a5baf549e31b4f02de78638a3f480421440f4e38ea32e8cd014cee0e0
SSDEEP 1536:0rAGBBNImxCyakScpiByZYeNEHTeUOuNUBO0YgHXH6M1Sgqjw5:0rAGr/PxSc0eH6HTeUOuec0Yg3apK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mind

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Mind
Size 98KB
SHA256 0d5602ba1e91c3672992926d40ade260db5df228af923df30c5bf4242df2f133
MD5 83aeea636c54d733cc32ab493a5364d4
SHA1 545c1357944c51e9f8d2110d01dfa2076a716613
SHA512 f61acfb0b7ace3331945dd1b623fed445b8e2641380861708d1146ca595bb921b81025f9e39aa8c94f7fef20635f009fd8bd4697227f61ed7b5dee56466b616a
SSDEEP 1536:0Is2ziQD2tR/i0027EM/awuUwU7KxQefixl2vqWWGlHHvpKa5Gk6/vij4O:0Is8di/37EM/j2xQeixApVIa0/viH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Orders

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Orders
Size 221KB
SHA256 4536f5904c52e8e2b0b7aa3c5cf2527fe09dad507a40335473d4386eef02e0d7
MD5 634d131aef5fb9666cdcaf3c8c2c4260
SHA1 87200be917ff801478dea404ef60980c45d05cde
SHA512 aa87118cd7cf36b567d58b0db75bf3e2058c8e3f7ace69e8be0e7f79e10ad316101bbdd3facaf9e725b75e4b755b8f674c1070a51da4dbc0720f4d1de1dbd3c0
SSDEEP 3072:XaAt7P+6i/xhgariwYLTNaWy4ZNoBVxjCPjojv:XdFW6wgarnYNhBZ2BV8jojv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Origins

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Origins
Size 23KB
SHA256 6cb0f1e1d71431257f46db15167cd8bf22313e6ab3425bad00c64ea918f213a5
MD5 14dbb5fcfe93369164f6423ef2a9a618
SHA1 c5d414a05eecfd9ba26ede311dbe0c6addc62f79
SHA512 28e64e8d41da778cd1ba5c29667fd54f3ca5af276d87f8aa3d14ec77a1c15e04f5a58d7c0e5df8807d2c5381960f3fc25394f949365d09ebf8455a63470f2e8e
SSDEEP 384:euFFnJ3Qk/9p5unBL9kgyEGQYeE5b712pSnSLEf1qjWfEPE3BZbYDv70:Hp3Qc9W9kgyEGneE17MuSLwfEPE37YD4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Titten

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Titten
Size 104KB
SHA256 698e3aba58edb38fb5c26cb561c65811636a18f8dd28edbe2cf9fcba87df229c
MD5 237d2f88a43c21c9bc5599be91b3571b
SHA1 e94251dd329300f7c74631cdaafd5f504c4866fa
SHA512 79249b8a15e807c2af0423d2fb5615d96e95ee1a7e4e6e10fa196838194c1ee16f11c41d5580c9d40a693937fecf392e1c607439e3012bb035a99fa7a1334213
SSDEEP 1536:Wg/Pp5q/qw0j8sgyZpQ4VMEPmfP/b/psgrO4aK9iwcznrQfy0c4cDTOelOFCOBSH:9XqGjLPQ6ClAMfA4lelIJBSLPNV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Towards

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Towards
Size 288KB
SHA256 6f47415606c5b750d66c7340f65a3fecafe28b2e7a83dadc3dc154d72b727fff
MD5 9747e2f0863c6acee2cad8e96980658a
SHA1 3da9cfb884a513a5ecd9138d09287055a423d110
SHA512 a48acf816e1d607925a549b904a52665c5aaab37a3a9f198183e78c7ebff22806c1d74b934b01298da82b5701d553d1da4ebf1862099ed0091cedfe0571bb744
SSDEEP 6144:+VPlcBgtoTqnvAfcaG9b2M8JTDD/xcq21R1p/rAOPOei7j:YlcqikvAfcN9b2MyZa31troPj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Weather

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Weather
Size 107KB
SHA256 9e5bdbe0a3f24b4700e379f38fe40928ebfe69fc2fb2e9d2fd942b6cf7991545
MD5 c7980f56319f536020f8bef4bb8974c0
SHA1 adb8adf76b9add121cefbce1c58ca5510d21f671
SHA512 cb37715791f3e3d8c4bd30ccc8e3e8e84f4a8720467f80e742d70aa6e9755f1ecec9db8cf55d4d8f8572dce818f55ff7c3771bbacd6fa597c4db04ae56389e70
SSDEEP 3072:BbqImoZ2Xq13nYOeI9SjFlWkHtI+m+xH0kXnb85y:pqIbX13nYOh+dtIyV0krz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/344-36-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/344-37-0x0000000000400000-0x000000000040B000-memory.dmp

Download