smokeloader | 77ba3a5058034fe2c3d7c63abe1a8e8e6bf7fecfcf8b4c482098547ed0a7a2b3

Analysis

max time kernel
94s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33d5d9bd28f65134d50beafebfc75bd41e00ad5ee832a1cd9d6cff8089fc03f8.exe
Size

325KB
MD5

f4d6bab1ae5f0408bf7a961ac4e1eec9
SHA1

730b116f176a14cad5bf6d4795f51c63fb0bef07
SHA256

33d5d9bd28f65134d50beafebfc75bd41e00ad5ee832a1cd9d6cff8089fc03f8
SHA512

0638e0164987a791ea192d58051c432bf09091459c8342f6680b1b5aeed33ecf8429ee9153e9719ea8e0102b283fad74c786899d8a651c02a37c6ee55f522a2e
SSDEEP

6144:PP7fvOn4EsDkGsBOmWCZhVV4E+O13oXc5:37fvOn4EsDkymx0DOn

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4988 524 WerFault.exe 33d5d9bd28f65134d50beafebfc75bd41e00ad5ee832a1cd9d6cff8089fc03f8.exe

pid	pid_target	process	target process
4988	524	WerFault.exe	33d5d9bd28f65134d50beafebfc75bd41e00ad5ee832a1cd9d6cff8089fc03f8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

33d5d9bd28f65134d50beafebfc75bd41e00ad5ee832a1cd9d6cff8089fc03f8.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33d5d9bd28f65134d50beafebfc75bd41e00ad5ee832a1cd9d6cff8089fc03f8.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

33d5d9bd28f65134d50beafebfc75bd41e00ad5ee832a1cd9d6cff8089fc03f8.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	33d5d9bd28f65134d50beafebfc75bd41e00ad5ee832a1cd9d6cff8089fc03f8.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	33d5d9bd28f65134d50beafebfc75bd41e00ad5ee832a1cd9d6cff8089fc03f8.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	33d5d9bd28f65134d50beafebfc75bd41e00ad5ee832a1cd9d6cff8089fc03f8.exe

C:\Users\Admin\AppData\Local\Temp\33d5d9bd28f65134d50beafebfc75bd41e00ad5ee832a1cd9d6cff8089fc03f8.exe
"C:\Users\Admin\AppData\Local\Temp\33d5d9bd28f65134d50beafebfc75bd41e00ad5ee832a1cd9d6cff8089fc03f8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 352
  2⤵
  - Program crash
  PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 524 -ip 524
1⤵
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-2-0x00000000001D0000-0x00000000001D9000-memory.dmp

Filesize
36KB

Download
memory/524-1-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/524-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/524-4-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/524-5-0x00000000001D0000-0x00000000001D9000-memory.dmp

Filesize
36KB

Download
memory/524-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download