SmokeLoader Backdoor/Loader: Process Hollowing Injection into explorer.exe with Anti-VM/Anti-Debug Evasion (Smoky Spider)

Key facts for SmokeLoader process hollowing injection

Detection coverage for SmokeLoader process hollowing injection

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2482 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SmokeLoader Process Hollowing into explorer.exe (SPL)

Detects the SmokeLoader process-hollowing injection chain — Sysmon EventID 25 (ProcessTampering, Type='Image is replaced') or EventID 8 (CreateRemoteThread) targeting explorer.exe — optionally correlated with preceding anti-VM/sandbox discovery command lines (WMI Win32_ComputerSystem/Win32_VideoController queries, VirtualBox/VMware/Sandboxie artifact checks). Matches SMOKY SPIDER's documented ZwUnmapViewOfSection + VirtualAllocEx + ZwWriteVirtualMemory + ResumeThread sequence against a CREATE_SUSPENDED explorer.exe.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1055.012, T1497.001, T1059.005
• Data sources: sysmon, microsoft_defender_for_endpoint_device_events, microsoft_defender_for_endpoint_device_process_events
• Severity: high
• Confidence: high

Splunk SPL

`comment("SmokeLoader: process hollowing into explorer.exe, optionally preceded by anti-VM/sandbox discovery commands")`
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=25 OR EventCode=8 OR EventCode=1)
earliest=-24h
| eval detection_signal=case(
    EventCode=25 AND like(TargetImage, "%\\explorer.exe") AND Type="Image is replaced", "process_tampering_explorer_hollowed",
    EventCode=8 AND like(TargetImage, "%\\explorer.exe") AND SourceImage!=TargetImage, "cross_process_remote_thread_explorer",
    EventCode=1 AND match(CommandLine, "(?i)(Win32_ComputerSystem|Win32_VideoController|VBOX|VMware|vboxmouse|vboxguest|vmci|SbieDll|Sandboxie|VirtualBox|VMToolsd)"), "anti_vm_sandbox_discovery"
)
| where isnotnull(detection_signal)
| stats min(_time) as first_seen, max(_time) as last_seen, count, values(detection_signal) as signals, values(CommandLine) as command_lines, values(SourceImage) as source_images by ComputerName, User, TargetImage, Image
| where mvcount(signals) >= 1
| sort - last_seen

Microsoft KQL

// SmokeLoader: process hollowing into explorer.exe with optional anti-VM/sandbox discovery precursor
let AntiVMDiscovery = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("Win32_ComputerSystem","Win32_VideoController","VBOX","VMware","vboxmouse","vboxguest","vmci","SbieDll","Sandboxie","VirtualBox","VMToolsd")
| project Timestamp, DeviceName, AccountName, AntiVmCommandLine = ProcessCommandLine;
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("ProcessTampering", "CreateRemoteThreadApiCall")
| where FileName =~ "explorer.exe"
| project Timestamp, DeviceName, AccountName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, FileName
| join kind=leftouter AntiVMDiscovery on DeviceName
| project Timestamp, DeviceName, AccountName, ActionType, InitiatingProcessFileName, InitiatingProcessParentFileName, FileName, AntiVmCommandLine
| sort by Timestamp desc

Sigma

title: SmokeLoader Process Hollowing Injection into explorer.exe
id: 7c1e0e2a-4b3f-4a2d-9f7a-1d8c2e5b6a01
status: experimental
description: Detects process tampering (image replacement) or cross-process remote thread creation targeting explorer.exe, consistent with SmokeLoader's ZwUnmapViewOfSection/VirtualAllocEx/NtWriteVirtualMemory process-hollowing injection chain (Smoky Spider).
references:
    - https://rexorvc0.com/2022/08/29/SmokeLoader/
    - https://attack.mitre.org/software/S0226/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-13
tags:
    - attack.defense-evasion
    - attack.t1055.012
    - attack.t1497.001
    - attack.s0226
    - attack.group.smoky-spider
    - attack.tool.smokeloader
logsource:
    category: process_tampering
    product: windows
detection:
    selection_tamper:
        TargetImage|endswith: '\explorer.exe'
        Type: 'Image is replaced'
    selection_remote_thread:
        EventID: 8
        TargetImage|endswith: '\explorer.exe'
    condition: 1 of selection_*
falsepositives:
    - Legitimate software update or repair utilities that re-launch/patch explorer.exe (rare)
    - EDR/AV self-protection modules performing benign injection into shell processes
level: high

Known false positives:

• Legitimate software update, repair, or shell-extension utilities that legitimately re-launch or patch explorer.exe
• EDR/AV self-protection or application-compatibility shims performing benign cross-process thread creation into shell processes

Tuning notes: Baseline explorer.exe ProcessTampering/CreateRemoteThread events in your environment first (some AV/EDR agents legitimately touch explorer.exe); suppress known-good vendor process names as SourceImage/InitiatingProcessFileName. Tighten the anti-VM discovery clause to only correlate (not alert standalone) if analyst volume is high, since WMI system queries alone are common in legitimate inventory/monitoring tooling.

• 🔒 SmokeLoader Process Hollowing into explorer.exe (KQL) · unlock with TL Creds
• 🔒 SmokeLoader Persistence, Browser Credential Theft & Local Email Collection (KQL) · unlock with TL Creds
• 🔒 SmokeLoader HTTP C2 to Known Infrastructure or Disposable-TLD Beaconing (KQL) · unlock with TL Creds
• 🔒 SmokeLoader Process Hollowing Injection into explorer.exe (Sigma) · unlock with TL Creds
• 🔒 SmokeLoader Persistence via Registry Run Key or Scheduled Task Creation (Sigma) · unlock with TL Creds
• 🔒 SmokeLoader HTTP C2 Beaconing to Known Infrastructure or Disposable TLDs (Sigma) · unlock with TL Creds
• 🔒 SmokeLoader Persistence, Browser Credential Theft & Local Email Collection (SPL) · unlock with TL Creds
• 🔒 SmokeLoader HTTP C2 to Known Infrastructure or Disposable-TLD / Decoy-404 Beaconing (SPL) · unlock with TL Creds

Indicators of compromise for SmokeLoader process hollowing injection

As of 2026-11-03, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-2482.

Sample indicators (3 of 30)

• IP address: 216.128.137[.]31
• Domain: host-file-host6[.]com
• File hash: ebdebba349aba676e9739df18c503ab8c16c7fa1b853fd183f0a005c0e4f68ae

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

How SmokeLoader process hollowing injection works

A 2022 technical writeup by REXor documents the injection chain in detail alongside a live C2 IP/domain list and ten sample SHA256 hashes.

SmokeLoader (aliases: Smoke Bot, Dofoil, Sharik) is a criminal loader/backdoor that has been sold and operated on underground forums since 2011 by the developer tracked by CrowdStrike as SMOKY SPIDER, a financially motivated actor believed to operate out of the Russian Federation / Eastern Europe. The malware's core value proposition to its operator and its criminal customers is delivery-as-a-service: SmokeLoader itself has limited built-in capability, and instead focuses on reliably landing on a host, evading analysis, and pulling down whichever second-stage modules (information stealers, ransomware, banking trojans, or additional loaders) the operator or a paying third party wants executed.

The infection chain documented in the primary source begins with a dropper delivered via phishing attachments, drive-by downloads, exploit kits, or bundled with cracked/pirated software (a common PPI "pay-per-install" monetization channel for this actor). On execution, the initial-stage binary spawns a second copy of itself in a suspended state using CreateProcessInternalA/W with the CREATE_SUSPENDED flag, then performs textbook process hollowing against the suspended process image: it calls ZwUnmapViewOfSection to remove the original (legitimate) image from the process's address space, VirtualAlloc/VirtualAllocEx to reserve fresh memory in the target, ZwWriteVirtualMemory/WriteProcessMemory to write the malicious PE image into that space, and ResumeThread to resume execution of the now-hollowed process. In observed builds, explorer.exe is the preferred hollowing target, letting the malicious code execute under a trusted, always-running system process to blend into normal endpoint telemetry.

Before and during this injection sequence, SmokeLoader runs a battery of anti-analysis checks: anti-VM/sandbox detection (T1497.001-class system fingerprinting to identify virtualized analysis environments), anti-debugger checks to detect attached debuggers, and code obfuscation techniques including hidden/indirect call constructions and abuse of the RET instruction to break static disassembly and control-flow-graph reconstruction. Packed sections with abnormally high entropy further frustrate static signature detection. API resolution is deferred at runtime via LoadLibrary + GetProcAddress rather than static import-table linking, denying analysts an easy API-call inventory from the PE header alone.

Once injected and running inside explorer.exe, SmokeLoader establishes command-and-control over HTTP(S), historically favoring encoded/encrypted request and response bodies and, in many campaigns, decoy traffic to legitimate high-reputation domains (e.g., microsoft.com, bing.com) that return HTTP 404 while carrying disguised C2 data in the response body — a technique intended to blend malicious egress into background enterprise web traffic and defeat simple domain-reputation network controls. The 2022 sample set analyzed here communicated with a defined set of C2 IPs and a rotating pool of throwaway domains registered across cheap/free TLDs (.top, .tk, .ga, .ml, .tw, .ru, .co.ug) consistent with the bulletproof-hosting and disposable-domain patterns typical of SMOKY SPIDER's infrastructure.

SmokeLoader's downstream module ecosystem (documented broadly across the vendor/community corpus, not solely this sample) has historically included credential-stealing modules targeting browser-stored credentials and files containing unsecured credentials, local email collection, and the ability to fetch/execute follow-on payloads including information stealers (Lumma, RedLine, Vidar reported in later campaigns) and other loaders. Persistence in documented builds is commonly achieved through Registry Run key / Startup folder placement and, in some builds, Scheduled Task creation, ensuring re-execution across reboots without relying on the injected explorer.exe process alone.

Attribution: MITRE ATT&CK catalogs SmokeLoader as Software S0226; CrowdStrike attributes its development and criminal operation to SMOKY SPIDER, active since at least 2011, financially motivated, distributing the loader itself and reselling execution slots to third-party criminal customers. Malpedia additionally cross-references the UAC-0006 activity cluster (a financially motivated group targeting Ukrainian entities) as an observed operator/user of SmokeLoader builds.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1055 Process Injection; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Discovery

T1057 Process Discovery

Execution

T1059.005 Visual Basic; T1106 Native API; T1204.002 User Execution

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1573.001 Encrypted Channel

Collection

T1114.001 Local Email Collection

Credential Access

T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers

Initial Access

T1566.001 Phishing

Remediation for SmokeLoader process hollowing injection

Immediate actions

• Block the documented C2 IPs (216.128.137.31, 8.209.71.53) and domains at perimeter firewall/DNS layer
• Add the ten published SHA256 hashes to EDR/AV blocklists and hunt for prior execution
• Hunt for explorer.exe processes exhibiting anomalous outbound HTTP connections or unexpected child processes/memory regions inconsistent with the legitimate binary
• Isolate and reimage any host confirmed to have executed a matching sample

Workarounds

• Block outbound access to newly-registered/low-reputation TLDs (.top, .tk, .ga, .ml, .co.ug) commonly abused for disposable SmokeLoader C2 domains where not required for business function

Longer-term hardening

• Deploy EDR with kernel-level API hooking/ETW-based detection for ZwUnmapViewOfSection, NtWriteVirtualMemory, and VirtualAllocEx sequences targeting explorer.exe or other long-lived system processes
• Enable memory-scanning/behavioral detection for process hollowing patterns (RWX memory allocation in a process whose original image was unmapped)
• Deploy network detection for HTTP beacons disguised as traffic to high-reputation domains returning anomalous 404 response bodies
• Restrict execution of unsigned binaries from user-writable directories (Temp, Downloads, AppData) via application control policy

Affected and fixed versions

• Microsoft — Windows (all supported desktop versions)
  Vulnerable versions: Windows 7 and later, x86/x64

Timeline of SmokeLoader process hollowing injection

Last updated 2026-11-03 · revalidated 1× · latest source

• 2011-01-01 locked-ioc-23 (Smoke Bot) first made available for sale on underground criminal forums by its developer, later tracked by CrowdStrike as locked-ioc-20.
• 2016-08-01 Malwarebytes Labs publishes 'Smoke Loader - downloader with a smokescreen still alive,' documenting continued active use of the loader years after initial release.
• 2017-01-01 locked-ioc-23 2017 version updated C2 communication to use two static 4-byte RC4 keys for requests and responses (year-level precision per VMRay).
• 2020-01-01 CrowdStrike's 2020 Global Threat Report names locked-ioc-20 as the criminal developer/operator behind locked-ioc-23 (Smoke Bot).
• 2022-08-29 Ten SHA256 sample hashes and associated C2 infrastructure (2 IPs, 15 domains across .top/.tk/.ga/.ml/.tw/.ru/.co.ug TLDs) disclosed alongside the technical writeup.
• 2022-08-29 REXor publishes a technical analysis of a locked-ioc-23 sample detailing its process-hollowing injection into explorer.exe, anti-VM/anti-debug checks, and a live C2 IP/domain list with ten SHA256 sample hashes.
• 2024-05-27 Europol-coordinated Operation Endgame began, targeting locked-ioc-23, IcedID, Pikabot, Trickbot, Bumblebee and SystemBC loader infrastructure.
• 2024-05-29 First Operation Endgame action phase concluded with over 100 servers seized worldwide, including locked-ioc-23 infrastructure and a customer database.
• 2025-04-09 Europol announced follow-up action: at least five locked-ioc-23 customers of the pay-per-install botnet operated by 'Superstar' were detained after identification from the seized database.
• 2026-09-13 TL-Intel Harness compiles cross-referenced research on the sample, corroborating IOCs, ATT&CK mapping (S0226), and locked-ioc-20/UAC-0006 attribution against MITRE, Malpedia, CrowdStrike, and Huntress sources.

Update history

• 2026-11-03 — locked-ioc-23 malware loader (locked-ioc-20): process hollowing, explorer.exe injection and pay-per-install botnet: What changed No severity/exploitability change warranted. Status left as ACTIVE: the newer report suggests MONITORING after law-enforcement disruption, but that would be a de-escalation and Zscaler-type reporting indicates locked-ioc-23 res

Sources cited for SmokeLoader process hollowing injection

• NJCCIC Threat Profile: Smoke Loader cyber.nj.gov · Advisory · 2026-09-13
• Smoke Loader, Software S0226 MITRE · Research · 2026-09-13
• SmokeLoader (Malware Family) malpedia.caad.fkie.fraunhofer.de · Research · 2026-09-13
• SMOKY SPIDER (Threat Actor) malpedia.caad.fkie.fraunhofer.de · Research · 2026-09-13
• Smoky Spider Adversary Profile CrowdStrike · Vendor report · 2026-09-13
• SmokeLoader Malware: Analysis, Detection, Removal Huntress · Vendor report · 2026-09-13
• Deep Analysis of SmokeLoader n1ght-w0lf.github.io · Research · 2026-09-13
• Quick-Analysis: SmokeLoader.md GitHub · Code repository · 2022-08-29
• Smoke Loader - downloader with a smokescreen still alive blog.malwarebytes.com · Blog · 2016-08-01
• SmokeLoader rexorvc0.com · Analysis · 2022-08-29

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

Previous and next in malware

• Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain Previous report
• Compromised HBO Max Reddit Account Distributes ClickFix Malware in "PasteSwitch" Cross-Platform Malvertising Campaign Next report