smokeloader | 2d04fe9a46b612a0ee4ac34e61d6449edd043378bd7d07791ec1fd9891ee4778

Analysis

max time kernel
93s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d04fe9a46b612a0ee4ac34e61d6449edd043378bd7d07791ec1fd9891ee4778.exe
Size

230KB
MD5

841dd5e68fb06740c955a5f58cfcb44e
SHA1

834f1a81625d4c45bbc7f7ad8ed9fa05e7379485
SHA256

2d04fe9a46b612a0ee4ac34e61d6449edd043378bd7d07791ec1fd9891ee4778
SHA512

232ce900cd054bc4b7bbaebd848f87d2d590ab4d090b3bf1ef493c402f26a9198f07a987163c54260bcf6039fc9752eca9cdcbb441d342fe00e73afc57eb0f9a
SSDEEP

3072:+3l7Wpw7SH+ahYg5wH91Jl0yaS5JUznpR2sm8Q8wc:I79+PhJwhcbpR2J8bwc

Score

10^/10

smokeloader pub3 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4240	2816	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d04fe9a46b612a0ee4ac34e61d6449edd043378bd7d07791ec1fd9891ee4778.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2d04fe9a46b612a0ee4ac34e61d6449edd043378bd7d07791ec1fd9891ee4778.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2d04fe9a46b612a0ee4ac34e61d6449edd043378bd7d07791ec1fd9891ee4778.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2d04fe9a46b612a0ee4ac34e61d6449edd043378bd7d07791ec1fd9891ee4778.exe

C:\Users\Admin\AppData\Local\Temp\2d04fe9a46b612a0ee4ac34e61d6449edd043378bd7d07791ec1fd9891ee4778.exe
"C:\Users\Admin\AppData\Local\Temp\2d04fe9a46b612a0ee4ac34e61d6449edd043378bd7d07791ec1fd9891ee4778.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:2816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 356
  2⤵
  - Program crash
  PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2816 -ip 2816
1⤵
PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2816-1-0x00000000007E0000-0x00000000008E0000-memory.dmp

Filesize
1024KB

Download
memory/2816-2-0x0000000000670000-0x000000000067B000-memory.dmp

Filesize
44KB

Download
memory/2816-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2816-5-0x0000000000670000-0x000000000067B000-memory.dmp

Filesize
44KB

Download
memory/2816-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2816-4-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download