Procedure examples

The SMOKEDHAM source code is embedded in the dropper as an encrypted string.

SMOKEDHAM has used whoami commands to identify system owners.

SMOKEDHAM has exfiltrated data to its C2 server.

SMOKEDHAM can continuously capture keystrokes.

SMOKEDHAM can execute Powershell commands sent from its C2 server.

SMOKEDHAM has communicated with its C2 servers via HTTPS and HTTP POST requests.

SMOKEDHAM has used the systeminfo command on a compromised host.

SMOKEDHAM has used net.exe user and net.exe users to enumerate local accounts on a compromised host.

SMOKEDHAM has used a fronted domain to obfuscate its hard-coded C2 server domain.

SMOKEDHAM has added user accounts to local Admin groups.

SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.

SMOKEDHAM has used Powershell to download UltraVNC and ngrok from third-party file sharing sites.

SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.

SMOKEDHAM can capture screenshots of the victim’s desktop.

SMOKEDHAM has encoded its C2 traffic with Base64.

SMOKEDHAM has created user accounts.

SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.

SMOKEDHAM has used reg.exe to create a Registry Run key.

SMOKEDHAM has modified the Registry to hide created user accounts from the Windows logon screen.

SMOKEDHAM has encrypted its C2 traffic with RC4.

SMOKEDHAM has been delivered via malicious links in phishing emails.