smokeloader | c5adf0828a7f84fa39ba221b321f7a4246dd29f2a3fe172e3992f943362f79eb

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-04-2024 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68ae12a736293b56bc79182ffa241a2c_JaffaCakes118.exe
Size

337KB
MD5

68ae12a736293b56bc79182ffa241a2c
SHA1

bcf1f989f763cf922f8f2f941647a5f9574887e7
SHA256

c5adf0828a7f84fa39ba221b321f7a4246dd29f2a3fe172e3992f943362f79eb
SHA512

1b832a10cd745036373b7bbbd40d4ae00fec8addb5db8c1f6ad71c80904c8d4b1077b393ea8bcd3d711b7099a4a97320f9cffce97b425ecab5bc254608473f88
SSDEEP

6144:G5eV0uWDSsSD3rNZrnRHUwmavoOMJWVnboU6H3IBK:eH5Sr5ZLRHUIvkJMnboP0

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2020

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1368

pid	process
1368

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

68ae12a736293b56bc79182ffa241a2c_JaffaCakes118.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	68ae12a736293b56bc79182ffa241a2c_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	68ae12a736293b56bc79182ffa241a2c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	68ae12a736293b56bc79182ffa241a2c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

68ae12a736293b56bc79182ffa241a2c_JaffaCakes118.exe

pid	process
1724	68ae12a736293b56bc79182ffa241a2c_JaffaCakes118.exe
1724	68ae12a736293b56bc79182ffa241a2c_JaffaCakes118.exe
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

68ae12a736293b56bc79182ffa241a2c_JaffaCakes118.exe

pid process

1724 68ae12a736293b56bc79182ffa241a2c_JaffaCakes118.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1368
1368
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1368
1368

pid	process
1368
1368

pid	process
1368
1368

C:\Users\Admin\AppData\Local\Temp\68ae12a736293b56bc79182ffa241a2c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68ae12a736293b56bc79182ffa241a2c_JaffaCakes118.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-4-0x0000000002B30000-0x0000000002B45000-memory.dmp

Filesize
84KB

Download
memory/1724-2-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/1724-1-0x0000000001B10000-0x0000000001C10000-memory.dmp

Filesize
1024KB

Download
memory/1724-3-0x0000000000400000-0x00000000016C8000-memory.dmp

Filesize
18.8MB

Download
memory/1724-5-0x0000000000400000-0x00000000016C8000-memory.dmp

Filesize
18.8MB

Download