smokeloader | 218ae2e9ccd0d778ca78c7aa8e9fd7101819507d0f9da4bfbc40687063bd7fd4

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
Size

310KB
MD5

2c25677594d9f6c2e50ade274357d4e6
SHA1

cd3cfda94dbfc0e6cb2f8f1e0740503eed4505f1
SHA256

218ae2e9ccd0d778ca78c7aa8e9fd7101819507d0f9da4bfbc40687063bd7fd4
SHA512

adc8cf97850f2127caf4266b6af7be0e21df12dd48819dd05a1c60dfba2799d9fad8e42ed63c7196dc99608b4adcadb9c573b586d6d67c8fc3e0d1cdf6e20686
SSDEEP

6144:MFpSab31KeVbae9j9GavOuHsppLbsmAcQUtPgNq:MFpHbEeZ9RGaGJppLHlQUtP0

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://honawey7.xyz/

http://wijibui0.xyz/

http://hefahei6.xyz/

http://pipevai4.xyz/

http://nalirou7.xyz/

http://xacokuo8.xyz/

http://hajezey1.xyz/

http://gejajoo7.xyz/

http://sysaheu9.xyz/

http://rixoxeu9.xyz/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

3360
Suspicious use of SetThreadContext 1 IoCs

Processes:

2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe

description pid process target process

PID 3776 set thread context of 4144 3776 2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe 2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe

pid	process
3360

description	pid	process	target process
PID 3776 set thread context of 4144	3776	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe

pid	process
4144	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
4144	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe

pid process

4144 2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3360

pid	process
3360

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe

description	pid	process	target process
PID 3776 wrote to memory of 4144	3776	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
PID 3776 wrote to memory of 4144	3776	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
PID 3776 wrote to memory of 4144	3776	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
PID 3776 wrote to memory of 4144	3776	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
PID 3776 wrote to memory of 4144	3776	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
PID 3776 wrote to memory of 4144	3776	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe	2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3776

C:\Users\Admin\AppData\Local\Temp\2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c25677594d9f6c2e50ade274357d4e6_JaffaCakes118.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3708 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:2264

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3360-5-0x0000000003170000-0x0000000003186000-memory.dmp

Filesize
88KB

Download
memory/3776-1-0x0000000001810000-0x0000000001910000-memory.dmp

Filesize
1024KB

Download
memory/3776-2-0x0000000003400000-0x0000000003409000-memory.dmp

Filesize
36KB

Download
memory/4144-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4144-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4144-6-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/4144-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download