smokeloader | 1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe
Size

247KB
MD5

805d475d63cb9e43dd2b2a4e51fef22e
SHA1

2cd2f35437e227bfdcc5d493c53aa33ea96ef6e8
SHA256

1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028
SHA512

d4ae12bb46f3a353fbfbf264e2d2451b0fe4d88f784c764a769010c655343bd7a2886b46b322a0dbde762c0588a424c5dc60fb28bef93691debfb76a3b8cff89
SSDEEP

1536:6lkQFAhLLnr1SGehNq456Z9cNEiqv2XXCev6wKijpdsm1jwEHsPxm5tVe2tVaPcT:ItFAhLLnKXlKkzd1ZHsPA5u2zoYkPp0

Score

10^/10

smokeloader pub2 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5088	2416	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe

C:\Users\Admin\AppData\Local\Temp\1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe
"C:\Users\Admin\AppData\Local\Temp\1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 352
  2⤵
  - Program crash
  PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2416 -ip 2416
1⤵
PID:4008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-1-0x0000000000540000-0x0000000000640000-memory.dmp

Filesize
1024KB

Download
memory/2416-2-0x0000000002060000-0x000000000206B000-memory.dmp

Filesize
44KB

Download
memory/2416-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2416-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2416-5-0x0000000002060000-0x000000000206B000-memory.dmp

Filesize
44KB

Download
memory/2416-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download