# SmokeLoader Backdoor/Loader: Process Hollowing Injection into explorer.exe with Anti-VM/Anti-Debug Evasion (Smoky Spider)

> SmokeLoader is a modular backdoor/loader, developed and operated by the financially motivated Smoky Spider group since 2011, that injects into explorer.exe via classic process hollowing (ZwUnmapViewOfSection + VirtualAlloc + ZwWriteVirtualMemory) and layers anti-VM, anti-debug, and code-obfuscation checks before establishing HTTP-based C2 to download and execute additional payloads. A 2022 technical writeup by REXor documents the injection chain in detail alongside a live C2 IP/domain list and ten sample SHA256 hashes.

- **Published:** 2026-09-13T00:00:00Z
- **Last reviewed:** 2026-11-03T08:23:28.613Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2482
- **ID:** TL-2026-2482
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** SMOKY SPIDER (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

SmokeLoader (aliases: Smoke Bot, Dofoil, Sharik) is a criminal loader/backdoor that has been sold and operated on underground forums since 2011 by the developer tracked by CrowdStrike as SMOKY SPIDER, a financially motivated actor believed to operate out of the Russian Federation / Eastern Europe. The malware's core value proposition to its operator and its criminal customers is delivery-as-a-service: SmokeLoader itself has limited built-in capability, and instead focuses on reliably landing on a host, evading analysis, and pulling down whichever second-stage modules (information stealers, ransomware, banking trojans, or additional loaders) the operator or a paying third party wants executed.

The infection chain documented in the primary source begins with a dropper delivered via phishing attachments, drive-by downloads, exploit kits, or bundled with cracked/pirated software (a common PPI "pay-per-install" monetization channel for this actor). On execution, the initial-stage binary spawns a second copy of itself in a suspended state using CreateProcessInternalA/W with the CREATE_SUSPENDED flag, then performs textbook process hollowing against the suspended process image: it calls ZwUnmapViewOfSection to remove the original (legitimate) image from the process's address space, VirtualAlloc/VirtualAllocEx to reserve fresh memory in the target, ZwWriteVirtualMemory/WriteProcessMemory to write the malicious PE image into that space, and ResumeThread to resume execution of the now-hollowed process. In observed builds, explorer.exe is the preferred hollowing target, letting the malicious code execute under a trusted, always-running system process to blend into normal endpoint telemetry.

Before and during this injection sequence, SmokeLoader runs a battery of anti-analysis checks: anti-VM/sandbox detection (T1497.001-class system fingerprinting to identify virtualized analysis environments), anti-debugger checks to detect attached debuggers, and code obfuscation techniques including hidden/indirect call constructions and abuse of the RET instruction to break static disassembly and control-flow-graph reconstruction. Packed sections with abnormally high entropy further frustrate static signature detection. API resolution is deferred at runtime via LoadLibrary + GetProcAddress rather than static import-table linking, denying analysts an easy API-call inventory from the PE header alone.

Once injected and running inside explorer.exe, SmokeLoader establishes command-and-control over HTTP(S), historically favoring encoded/encrypted request and response bodies and, in many campaigns, decoy traffic to legitimate high-reputation domains (e.g., microsoft.com, bing.com) that return HTTP 404 while carrying disguised C2 data in the response body — a technique intended to blend malicious egress into background enterprise web traffic and defeat simple domain-reputation network controls. The 2022 sample set analyzed here communicated with a defined set of C2 IPs and a rotating pool of throwaway domains registered across cheap/free TLDs (.top, .tk, .ga, .ml, .tw, .ru, .co.ug) consistent with the bulletproof-hosting and disposable-domain patterns typical of SMOKY SPIDER's infrastructure.

SmokeLoader's downstream module ecosystem (documented broadly across the vendor/community corpus, not solely this sample) has historically included credential-stealing modules targeting browser-stored credentials and files containing unsecured credentials, local email collection, and the ability to fetch/execute follow-on payloads including information stealers (Lumma, RedLine, Vidar reported in later campaigns) and other loaders. Persistence in documented builds is commonly achieved through Registry Run key / Startup folder placement and, in some builds, Scheduled Task creation, ensuring re-execution across reboots without relying on the injected explorer.exe process alone.

Attribution: MITRE ATT&CK catalogs SmokeLoader as Software S0226; CrowdStrike attributes its development and criminal operation to SMOKY SPIDER, active since at least 2011, financially motivated, distributing the loader itself and reselling execution slots to third-party criminal customers. Malpedia additionally cross-references the UAC-0006 activity cluster (a financially motivated group targeting Ukrainian entities) as an observed operator/user of SmokeLoader builds.

## MITRE ATT&CK

- T1059.005 Visual Basic
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1055.012 Process Hollowing
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1552.001 Credentials In Files
- T1555.003 Credentials from Web Browsers
- T1114.001 Local Email Collection
- T1071.001 Web Protocols
- T1566.001 Phishing
- T1204.002 User Execution
- T1106 Native API
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1057 Process Discovery
- T1573.001 Encrypted Channel
- T1105 Ingress Tool Transfer

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SmokeLoader Process Hollowing into explorer.exe (SPL)** (`TL-2026-2482-SPL-001`)

Detects the SmokeLoader process-hollowing injection chain — Sysmon EventID 25 (ProcessTampering, Type='Image is replaced') or EventID 8 (CreateRemoteThread) targeting explorer.exe — optionally correlated with preceding anti-VM/sandbox discovery command lines (WMI Win32_ComputerSystem/Win32_VideoController queries, VirtualBox/VMware/Sandboxie artifact checks). Matches SMOKY SPIDER's documented ZwUnmapViewOfSection + VirtualAllocEx + ZwWriteVirtualMemory + ResumeThread sequence against a CREATE_SUSPENDED explorer.exe.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1055.012, T1497.001, T1059.005
- **Data sources:** sysmon, microsoft_defender_for_endpoint_device_events, microsoft_defender_for_endpoint_device_process_events
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
`comment("SmokeLoader: process hollowing into explorer.exe, optionally preceded by anti-VM/sandbox discovery commands")`
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=25 OR EventCode=8 OR EventCode=1)
earliest=-24h
| eval detection_signal=case(
    EventCode=25 AND like(TargetImage, "%\\explorer.exe") AND Type="Image is replaced", "process_tampering_explorer_hollowed",
    EventCode=8 AND like(TargetImage, "%\\explorer.exe") AND SourceImage!=TargetImage, "cross_process_remote_thread_explorer",
    EventCode=1 AND match(CommandLine, "(?i)(Win32_ComputerSystem|Win32_VideoController|VBOX|VMware|vboxmouse|vboxguest|vmci|SbieDll|Sandboxie|VirtualBox|VMToolsd)"), "anti_vm_sandbox_discovery"
)
| where isnotnull(detection_signal)
| stats min(_time) as first_seen, max(_time) as last_seen, count, values(detection_signal) as signals, values(CommandLine) as command_lines, values(SourceImage) as source_images by ComputerName, User, TargetImage, Image
| where mvcount(signals) >= 1
| sort - last_seen
```

### Microsoft KQL

```kql
// SmokeLoader: process hollowing into explorer.exe with optional anti-VM/sandbox discovery precursor
let AntiVMDiscovery = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("Win32_ComputerSystem","Win32_VideoController","VBOX","VMware","vboxmouse","vboxguest","vmci","SbieDll","Sandboxie","VirtualBox","VMToolsd")
| project Timestamp, DeviceName, AccountName, AntiVmCommandLine = ProcessCommandLine;
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("ProcessTampering", "CreateRemoteThreadApiCall")
| where FileName =~ "explorer.exe"
| project Timestamp, DeviceName, AccountName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, FileName
| join kind=leftouter AntiVMDiscovery on DeviceName
| project Timestamp, DeviceName, AccountName, ActionType, InitiatingProcessFileName, InitiatingProcessParentFileName, FileName, AntiVmCommandLine
| sort by Timestamp desc
```

### Sigma

```yaml
title: SmokeLoader Process Hollowing Injection into explorer.exe
id: 7c1e0e2a-4b3f-4a2d-9f7a-1d8c2e5b6a01
status: experimental
description: Detects process tampering (image replacement) or cross-process remote thread creation targeting explorer.exe, consistent with SmokeLoader's ZwUnmapViewOfSection/VirtualAllocEx/NtWriteVirtualMemory process-hollowing injection chain (Smoky Spider).
references:
    - https://rexorvc0.com/2022/08/29/SmokeLoader/
    - https://attack.mitre.org/software/S0226/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-13
tags:
    - attack.defense-evasion
    - attack.t1055.012
    - attack.t1497.001
    - attack.s0226
    - attack.group.smoky-spider
    - attack.tool.smokeloader
logsource:
    category: process_tampering
    product: windows
detection:
    selection_tamper:
        TargetImage|endswith: '\explorer.exe'
        Type: 'Image is replaced'
    selection_remote_thread:
        EventID: 8
        TargetImage|endswith: '\explorer.exe'
    condition: 1 of selection_*
falsepositives:
    - Legitimate software update or repair utilities that re-launch/patch explorer.exe (rare)
    - EDR/AV self-protection modules performing benign injection into shell processes
level: high
```

**Known false positives:**

- Legitimate software update, repair, or shell-extension utilities that legitimately re-launch or patch explorer.exe
- EDR/AV self-protection or application-compatibility shims performing benign cross-process thread creation into shell processes

**Tuning notes:** Baseline explorer.exe ProcessTampering/CreateRemoteThread events in your environment first (some AV/EDR agents legitimately touch explorer.exe); suppress known-good vendor process names as SourceImage/InitiatingProcessFileName. Tighten the anti-VM discovery clause to only correlate (not alert standalone) if analyst volume is high, since WMI system queries alone are common in legitimate inventory/monitoring tooling.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SmokeLoader Process Hollowing into explorer.exe (KQL) (locked: unlock with TL Creds)
- SmokeLoader Persistence, Browser Credential Theft & Local Email Collection (KQL) (locked: unlock with TL Creds)
- SmokeLoader HTTP C2 to Known Infrastructure or Disposable-TLD Beaconing (KQL) (locked: unlock with TL Creds)
- SmokeLoader Process Hollowing Injection into explorer.exe (Sigma) (locked: unlock with TL Creds)
- SmokeLoader Persistence via Registry Run Key or Scheduled Task Creation (Sigma) (locked: unlock with TL Creds)
- SmokeLoader HTTP C2 Beaconing to Known Infrastructure or Disposable TLDs (Sigma) (locked: unlock with TL Creds)
- SmokeLoader Persistence, Browser Credential Theft & Local Email Collection (SPL) (locked: unlock with TL Creds)
- SmokeLoader HTTP C2 to Known Infrastructure or Disposable-TLD / Decoy-404 Beaconing (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `216.128.137[.]31`
- Domain: `host-file-host6[.]com`
- File hash: `ebdebba349aba676e9739df18c503ab8c16c7fa1b853fd183f0a005c0e4f68ae`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SmokeLoader](https://rexorvc0.com/2022/08/29/SmokeLoader/)
- [Quick-Analysis: SmokeLoader.md](https://github.com/vc0RExor/Quick-Analysis/blob/main/SmokeLoader/SmokeLoader.md)
- [Smoke Loader, Software S0226](https://attack.mitre.org/software/S0226/)
- [SmokeLoader (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader)
- [SMOKY SPIDER (Threat Actor)](https://malpedia.caad.fkie.fraunhofer.de/actor/smoky_spider)
- [Smoky Spider Adversary Profile](https://www.crowdstrike.com/en-us/adversaries/smoky-spider/)
- [SmokeLoader Malware: Analysis, Detection, Removal](https://www.huntress.com/threat-library/malware/smokeloader)
- [Smoke Loader - downloader with a smokescreen still alive](https://blog.malwarebytes.com/threat-analysis/2016/08/smoke-loader-downloader-with-a-smokescreen-still-alive)
- [NJCCIC Threat Profile: Smoke Loader](https://www.cyber.nj.gov/threat-landscape/malware/trojans/smoke-loader)
- [Deep Analysis of SmokeLoader](https://n1ght-w0lf.github.io/malware%20analysis/smokeloader/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2482