smokeloader | d32f57ddf4d662f0e217ea3c15f254aa70e052626e96b3da6c6017f7b3807fc4

General

Target

2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
Size

337KB
MD5

2b18c0755ae564abafc36b02742014f9
SHA1

36fbb007183250cc9ace71d8e2469310ca1416e7
SHA256

d32f57ddf4d662f0e217ea3c15f254aa70e052626e96b3da6c6017f7b3807fc4
SHA512

96562fc35fc0810660d542ce1c4d020c63efeb58bcb8bd1800c5054f10e28d828a13303bbb2d1b9b019e19bd4b6e6b64baea870f2794a4a19e61a8d6787011be
SSDEEP

6144:ygW3mN9IWTLJeLqd2cXu87tAN6f9EDFqYqwsK6agxYc:w2UWTLJMqd1+87tAUfGqYqwsJacYc

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://fazanaharahe10.top/

http://xandelissane20.top/

http://ustiassosale30.top/

http://cytheriata40.top/

http://ggiergionard50.top/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1200

pid	process
1200

Suspicious use of SetThreadContext 1 IoCs

Processes:

2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe

description	pid	process	target process
PID 2616 set thread context of 2232	2616	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe

pid	process
2232	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
2232	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe

pid process

2232 2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe

description	pid	process	target process
PID 2616 wrote to memory of 2232	2616	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
PID 2616 wrote to memory of 2232	2616	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
PID 2616 wrote to memory of 2232	2616	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
PID 2616 wrote to memory of 2232	2616	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
PID 2616 wrote to memory of 2232	2616	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
PID 2616 wrote to memory of 2232	2616	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
PID 2616 wrote to memory of 2232	2616	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe	2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2616

C:\Users\Admin\AppData\Local\Temp\2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b18c0755ae564abafc36b02742014f9_JaffaCakes118.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2232

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-7-0x00000000024E0000-0x00000000024F6000-memory.dmp

Filesize
88KB

Download
memory/2232-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2232-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2232-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2232-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2616-1-0x0000000001B10000-0x0000000001C10000-memory.dmp

Filesize
1024KB

Download
memory/2616-4-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads