smokeloader | 31b518925e54c787135d165b6f6af0872e2b8b5c076c6dc859ee907d33b37521

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2025 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31b518925e54c787135d165b6f6af0872e2b8b5c076c6dc859ee907d33b37521.exe
Size

268KB
MD5

2f3cbfe8ac517a67ebcfdd89b98d64f7
SHA1

1bf4867f69ea90353d228a8a8acb1b81400a3ffc
SHA256

31b518925e54c787135d165b6f6af0872e2b8b5c076c6dc859ee907d33b37521
SHA512

6d7436d6eec6f9387e5d58c17d68e5b44028d7da4c5a228463477fba5d9480667b8456f9b268ff29ea3b8e3c0828462b566315c364e40fee42f1c88efc2131fa
SSDEEP

3072:0L0c6VXaYfrTFtGCKmpBdNrwC5FVzSiVZNW:0Qcurfl9KmpB7ZSiVZg

Score

10^/10

smokeloader pub4 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4960	3716	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31b518925e54c787135d165b6f6af0872e2b8b5c076c6dc859ee907d33b37521.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	31b518925e54c787135d165b6f6af0872e2b8b5c076c6dc859ee907d33b37521.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	31b518925e54c787135d165b6f6af0872e2b8b5c076c6dc859ee907d33b37521.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	31b518925e54c787135d165b6f6af0872e2b8b5c076c6dc859ee907d33b37521.exe

C:\Users\Admin\AppData\Local\Temp\31b518925e54c787135d165b6f6af0872e2b8b5c076c6dc859ee907d33b37521.exe
"C:\Users\Admin\AppData\Local\Temp\31b518925e54c787135d165b6f6af0872e2b8b5c076c6dc859ee907d33b37521.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:3716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 352
  2⤵
  - Program crash
  PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3716 -ip 3716
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-2-0x0000000000590000-0x000000000059B000-memory.dmp

Filesize
44KB

Download
memory/3716-1-0x00000000005A0000-0x00000000006A0000-memory.dmp

Filesize
1024KB

Download
memory/3716-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3716-4-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3716-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3716-5-0x0000000000590000-0x000000000059B000-memory.dmp

Filesize
44KB

Download