smokeloader | d64e436e27550e192621203ca90973a7bc99e060c01a9b1b9fa427c068e4b422

Analysis

max time kernel
124s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d64e436e27550e192621203ca90973a7bc99e060c01a9b1b9fa427c068e4b422.exe
Size

240KB
MD5

bf6e7a12f9f3df4e90c2ac404072441b
SHA1

7e7833225c0748c24119e0492d70226e83a9a1d7
SHA256

d64e436e27550e192621203ca90973a7bc99e060c01a9b1b9fa427c068e4b422
SHA512

eb8458764034736733ecd96e58835b79c94d5e137bdaf44ec1cf452c9b6f62539a6ea97b138ca64ae29083013899139be7bb03593b4ba106db9abb6385e1acae
SSDEEP

6144:iFUMCN+4LQ587Vs9CKuD4Je385AM30mgXADT:DMCNrLQ58yCKuD45xgE

Score

10^/10

smokeloader pub2 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3864 876 WerFault.exe d64e436e27550e192621203ca90973a7bc99e060c01a9b1b9fa427c068e4b422.exe

pid	pid_target	process	target process
3864	876	WerFault.exe	d64e436e27550e192621203ca90973a7bc99e060c01a9b1b9fa427c068e4b422.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

d64e436e27550e192621203ca90973a7bc99e060c01a9b1b9fa427c068e4b422.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d64e436e27550e192621203ca90973a7bc99e060c01a9b1b9fa427c068e4b422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d64e436e27550e192621203ca90973a7bc99e060c01a9b1b9fa427c068e4b422.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d64e436e27550e192621203ca90973a7bc99e060c01a9b1b9fa427c068e4b422.exe

C:\Users\Admin\AppData\Local\Temp\d64e436e27550e192621203ca90973a7bc99e060c01a9b1b9fa427c068e4b422.exe
"C:\Users\Admin\AppData\Local\Temp\d64e436e27550e192621203ca90973a7bc99e060c01a9b1b9fa427c068e4b422.exe"
1⤵
- Checks SCSI registry key(s)
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 464
2⤵
- Program crash
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 876 -ip 876
1⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4404,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:8
1⤵
PID:3628

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/876-2-0x0000000004800000-0x000000000480B000-memory.dmp

Filesize
44KB

Download
memory/876-1-0x0000000002D10000-0x0000000002E10000-memory.dmp

Filesize
1024KB

Download
memory/876-4-0x0000000000400000-0x0000000002BF5000-memory.dmp

Filesize
40.0MB

Download