smokeloader | 676ad3031d6ddd60cac34add76c0285ebf2de3dfa97b5cb4ca5d4d93efc81cc1

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce69c1ce0021cbf3858ac6aa7438ff4a0a5facb527fe97d4ab9ed6957abd86d8.exe
Size

193KB
MD5

92469931cb44beb2b06bb19fc1f2a327
SHA1

85e96b0294d384522f948f43ea6030800cb19c05
SHA256

ce69c1ce0021cbf3858ac6aa7438ff4a0a5facb527fe97d4ab9ed6957abd86d8
SHA512

cb0de5c983e4fa57fbe323da982b478a7e142b313899e9b108619ab1bdb03b5f9bcaa56dc53e8302ffb0bcbbd27c3c94ec34ab2ce170acac8bb12e215e26dfec
SSDEEP

3072:4XSF8gLIjTVb5/7AU1lPTkHSc0K3sZO0NBegXnn1:Mq8gLoh9AalPu0u2NBeA

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	2184	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce69c1ce0021cbf3858ac6aa7438ff4a0a5facb527fe97d4ab9ed6957abd86d8.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ce69c1ce0021cbf3858ac6aa7438ff4a0a5facb527fe97d4ab9ed6957abd86d8.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ce69c1ce0021cbf3858ac6aa7438ff4a0a5facb527fe97d4ab9ed6957abd86d8.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ce69c1ce0021cbf3858ac6aa7438ff4a0a5facb527fe97d4ab9ed6957abd86d8.exe

C:\Users\Admin\AppData\Local\Temp\ce69c1ce0021cbf3858ac6aa7438ff4a0a5facb527fe97d4ab9ed6957abd86d8.exe
"C:\Users\Admin\AppData\Local\Temp\ce69c1ce0021cbf3858ac6aa7438ff4a0a5facb527fe97d4ab9ed6957abd86d8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 352
  2⤵
  - Program crash
  PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2184 -ip 2184
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-1-0x00000000005B0000-0x00000000006B0000-memory.dmp

Filesize
1024KB

Download
memory/2184-2-0x0000000002050000-0x0000000002059000-memory.dmp

Filesize
36KB

Download
memory/2184-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2184-4-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2184-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download