smokeloader | 1c47f14208e7f0af2ce1e8a8f89f586292ebf71baed71081d4100cfdc98cfd64

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-08-2024 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c47f14208e7f0af2ce1e8a8f89f586292ebf71baed71081d4100cfdc98cfd64.exe
Size

399KB
MD5

5e71ff1059428eb8aab7d14bd55632d3
SHA1

c7d617b29d57d1e2ff0c764735f215d2c6ffd1b1
SHA256

1c47f14208e7f0af2ce1e8a8f89f586292ebf71baed71081d4100cfdc98cfd64
SHA512

bbd6bde0692f103e78e8d5282b323b2bccc649ed40dcb3ab58d0a4213a5a8a8d2274bcf76213fd4204557b5327f3b97b260c16d1006a0e4958d6e03a6b081052
SSDEEP

6144:Ik04QHfLQcVQRP3VLdMhehccCdYu0rlDazyf1871T:IR4QH8cVQRPIcCdD0rlWuf187h

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
776	2948	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c47f14208e7f0af2ce1e8a8f89f586292ebf71baed71081d4100cfdc98cfd64.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1c47f14208e7f0af2ce1e8a8f89f586292ebf71baed71081d4100cfdc98cfd64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1c47f14208e7f0af2ce1e8a8f89f586292ebf71baed71081d4100cfdc98cfd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1c47f14208e7f0af2ce1e8a8f89f586292ebf71baed71081d4100cfdc98cfd64.exe

C:\Users\Admin\AppData\Local\Temp\1c47f14208e7f0af2ce1e8a8f89f586292ebf71baed71081d4100cfdc98cfd64.exe
"C:\Users\Admin\AppData\Local\Temp\1c47f14208e7f0af2ce1e8a8f89f586292ebf71baed71081d4100cfdc98cfd64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:2948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 352
  2⤵
  - Program crash
  PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2948 -ip 2948
1⤵
PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2948-1-0x00000000006D0000-0x00000000007D0000-memory.dmp

Filesize
1024KB

Download
memory/2948-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2948-3-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2948-5-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2948-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download