smokeloader | 6851b72e0bfaf608294bcac6ffef07e5e6591aee8b94ce9afad46b6e6cc32a59

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_installer/Wed09b2a8bc4f16cb.exe
Size

321KB
MD5

94d45a7ff853b3c5d3d441cf87a71688
SHA1

3327a1929c68a160ef6287277d4cff5747d7bb91
SHA256

172362b2f1f5dca51f1520fc186c1e67c7002f924420c5828b90e099e96b0476
SHA512

14d60e3dec00bb95d1ac35b85c4a63aef3f0157a783c79284b874691b14fc73480f34fc95e09a1e4f9a830ed73addbccb21fe99e5a8b7f3c9f6300ae21cca88f
SSDEEP

6144:HGxNBYU+iYJ5WWlFhY4yhsvPxP5Ji1HvmdgA/uA:cBYU+iE5DlFhY4yhsvPxGNv6gan

Score

10^/10

smokeloader pub5 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub5

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1704 2236 WerFault.exe Wed09b2a8bc4f16cb.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

Wed09b2a8bc4f16cb.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wed09b2a8bc4f16cb.exe

pid	pid_target	process	target process
1704	2236	WerFault.exe	Wed09b2a8bc4f16cb.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wed09b2a8bc4f16cb.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Wed09b2a8bc4f16cb.exe

description	pid	process	target process
PID 2236 wrote to memory of 1704	2236	Wed09b2a8bc4f16cb.exe	WerFault.exe
PID 2236 wrote to memory of 1704	2236	Wed09b2a8bc4f16cb.exe	WerFault.exe
PID 2236 wrote to memory of 1704	2236	Wed09b2a8bc4f16cb.exe	WerFault.exe
PID 2236 wrote to memory of 1704	2236	Wed09b2a8bc4f16cb.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09b2a8bc4f16cb.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09b2a8bc4f16cb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 136
  2⤵
  - Program crash
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-1-0x0000000002CE0000-0x0000000002DE0000-memory.dmp

Filesize
1024KB

Download
memory/2236-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2236-2-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/2236-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2236-4-0x0000000000400000-0x0000000002BAA000-memory.dmp

Filesize
39.7MB

Download