smokeloader | 8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7

General

Target

8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7.exe
Size

929KB
MD5

1e05a317170e161ce41edd9576a12112
SHA1

3c51bfe359199206e0179f39ce8657a50a33b452
SHA256

8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7
SHA512

374215799741f0495fa7ad78253e3b1ac904c4d1d91728269ab58cdb9b41d653a8caaa3a5fa1c39ab2422de64c89f3c68bc0bdee7860ed65e94a454f687fdf43
SSDEEP

24576:EUyp9f4yeSmpcK4lpRE8u+vTwQjfmadZ0Tbudct:QPfzmpcpRE8u+vBmaSi2

Score

10^/10

smokeloader backdoor discovery persistence trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader
Executes dropped EXE 1 IoCs

Processes:

detailcompetitive.exe

pid process

2956 detailcompetitive.exe

pid	process
2956	detailcompetitive.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

detailcompetitive.exe

description pid process target process

PID 2956 set thread context of 1084 2956 detailcompetitive.exe AddInProcess32.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

detailcompetitive.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language detailcompetitive.exe

description	pid	process	target process
PID 2956 set thread context of 1084	2956	detailcompetitive.exe	AddInProcess32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	detailcompetitive.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AddInProcess32.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AddInProcess32.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

detailcompetitive.exe

pid process

2956 detailcompetitive.exe
2956 detailcompetitive.exe
2956 detailcompetitive.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

detailcompetitive.exe

description pid process

Token: SeDebugPrivilege 2956 detailcompetitive.exe

pid	process
2956	detailcompetitive.exe
2956	detailcompetitive.exe
2956	detailcompetitive.exe

description	pid	process
Token: SeDebugPrivilege	2956	detailcompetitive.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7.exedetailcompetitive.exe

description	pid	process	target process
PID 4220 wrote to memory of 2956	4220	8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7.exe	detailcompetitive.exe
PID 4220 wrote to memory of 2956	4220	8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7.exe	detailcompetitive.exe
PID 4220 wrote to memory of 2956	4220	8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7.exe	detailcompetitive.exe
PID 2956 wrote to memory of 1084	2956	detailcompetitive.exe	AddInProcess32.exe
PID 2956 wrote to memory of 1084	2956	detailcompetitive.exe	AddInProcess32.exe
PID 2956 wrote to memory of 1084	2956	detailcompetitive.exe	AddInProcess32.exe
PID 2956 wrote to memory of 1084	2956	detailcompetitive.exe	AddInProcess32.exe
PID 2956 wrote to memory of 1084	2956	detailcompetitive.exe	AddInProcess32.exe
PID 2956 wrote to memory of 1084	2956	detailcompetitive.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7.exe
"C:\Users\Admin\AppData\Local\Temp\8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\detailcompetitive.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\detailcompetitive.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    - Checks SCSI registry key(s)
    PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\detailcompetitive.exe

Filesize
927KB

MD5
5d99042376131355be8579bd56100a82

SHA1
7cab6bbd33fbb030fc78b81466a387a1921d8dad

SHA256
fff0fecf9639148a95a39b9763361c1f3ceb2d4a54bce118b1c357504db6b9d8

SHA512
a168a70e6ff710b822d302579d8226901b637fdb1938b4a4846d8010572b2349abc3664aafff21366f3f6fa7957455ca5fa95a418ca674ca8442d6705d45acc7

Download Submit
memory/1084-18-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2956-12-0x00000000056D0000-0x00000000056DA000-memory.dmp

Filesize
40KB

Download
memory/2956-13-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/2956-8-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/2956-9-0x0000000005260000-0x00000000052FE000-memory.dmp

Filesize
632KB

Download
memory/2956-10-0x0000000005A10000-0x0000000005FB4000-memory.dmp

Filesize
5.6MB

Download
memory/2956-11-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/2956-6-0x0000000000200000-0x00000000002EC000-memory.dmp

Filesize
944KB

Download
memory/2956-7-0x00000000051C0000-0x000000000525C000-memory.dmp

Filesize
624KB

Download
memory/2956-14-0x00000000751AE000-0x00000000751AF000-memory.dmp

Filesize
4KB

Download
memory/2956-15-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/2956-16-0x0000000006750000-0x000000000676A000-memory.dmp

Filesize
104KB

Download
memory/2956-17-0x0000000006770000-0x0000000006776000-memory.dmp

Filesize
24KB

Download
memory/2956-5-0x00000000751AE000-0x00000000751AF000-memory.dmp

Filesize
4KB

Download
memory/2956-20-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads