smokeloader | 6851b72e0bfaf608294bcac6ffef07e5e6591aee8b94ce9afad46b6e6cc32a59

Analysis

max time kernel
95s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_installer/Wed09b2a8bc4f16cb.exe
Size

321KB
MD5

94d45a7ff853b3c5d3d441cf87a71688
SHA1

3327a1929c68a160ef6287277d4cff5747d7bb91
SHA256

172362b2f1f5dca51f1520fc186c1e67c7002f924420c5828b90e099e96b0476
SHA512

14d60e3dec00bb95d1ac35b85c4a63aef3f0157a783c79284b874691b14fc73480f34fc95e09a1e4f9a830ed73addbccb21fe99e5a8b7f3c9f6300ae21cca88f
SSDEEP

6144:HGxNBYU+iYJ5WWlFhY4yhsvPxP5Ji1HvmdgA/uA:cBYU+iE5DlFhY4yhsvPxGNv6gan

Score

10^/10

smokeloader pub5 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub5

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3704 1948 WerFault.exe Wed09b2a8bc4f16cb.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

Wed09b2a8bc4f16cb.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wed09b2a8bc4f16cb.exe

pid	pid_target	process	target process
3704	1948	WerFault.exe	Wed09b2a8bc4f16cb.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wed09b2a8bc4f16cb.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Wed09b2a8bc4f16cb.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Wed09b2a8bc4f16cb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Wed09b2a8bc4f16cb.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Wed09b2a8bc4f16cb.exe

C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09b2a8bc4f16cb.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09b2a8bc4f16cb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 352
  2⤵
  - Program crash
  PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1948 -ip 1948
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-1-0x0000000002D30000-0x0000000002E30000-memory.dmp

Filesize
1024KB

Download
memory/1948-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1948-2-0x00000000001C0000-0x00000000001C9000-memory.dmp

Filesize
36KB

Download
memory/1948-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1948-4-0x0000000000400000-0x0000000002BAA000-memory.dmp

Filesize
39.7MB

Download