smokeloader | 55a7aa311173e2a86f607102fa9943b6d0b209c47c875fea3bccb69d54bf966b

General

Target

9f1a276469e23f5205914ba85970c1e9_JaffaCakes118.exe
Size

340KB
MD5

9f1a276469e23f5205914ba85970c1e9
SHA1

9d146ab297342d2a555e45cb256ed9f1401104c8
SHA256

55a7aa311173e2a86f607102fa9943b6d0b209c47c875fea3bccb69d54bf966b
SHA512

4fe2a9dde61154fc21b5caa93f73c7f4c3e4efd88e3a83c876c592a65d46fccb2b2253f69ad1b9e0e77ac25639af68b29e10cd8bd8c7f0e7240105bccb044f6e
SSDEEP

6144:XEmpFZUuvbEYulcpb2GxnQfhejk/a5ShNH0CKpLku0o:X9pFZU4bEFCyGxn0ejk/fp0C6LB

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1256
Executes dropped EXE 1 IoCs

Processes:

gaggcug

pid process

1340 gaggcug

pid	process
1256

pid	process
1340	gaggcug

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

gaggcug9f1a276469e23f5205914ba85970c1e9_JaffaCakes118.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	gaggcug
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9f1a276469e23f5205914ba85970c1e9_JaffaCakes118.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9f1a276469e23f5205914ba85970c1e9_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9f1a276469e23f5205914ba85970c1e9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	gaggcug
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	gaggcug

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9f1a276469e23f5205914ba85970c1e9_JaffaCakes118.exe

pid	process
2900	9f1a276469e23f5205914ba85970c1e9_JaffaCakes118.exe
2900	9f1a276469e23f5205914ba85970c1e9_JaffaCakes118.exe
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256
1256

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

9f1a276469e23f5205914ba85970c1e9_JaffaCakes118.exegaggcug

pid process

2900 9f1a276469e23f5205914ba85970c1e9_JaffaCakes118.exe
1340 gaggcug

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1016 wrote to memory of 1340	1016	taskeng.exe	gaggcug
PID 1016 wrote to memory of 1340	1016	taskeng.exe	gaggcug
PID 1016 wrote to memory of 1340	1016	taskeng.exe	gaggcug
PID 1016 wrote to memory of 1340	1016	taskeng.exe	gaggcug

C:\Users\Admin\AppData\Local\Temp\9f1a276469e23f5205914ba85970c1e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9f1a276469e23f5205914ba85970c1e9_JaffaCakes118.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2900

C:\Windows\system32\taskeng.exe
taskeng.exe {37ED38FE-B09A-4F84-A224-2BFAA79C2DB1} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Roaming\gaggcug
C:\Users\Admin\AppData\Roaming\gaggcug
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\gaggcug

Filesize
340KB

MD5
9f1a276469e23f5205914ba85970c1e9

SHA1
9d146ab297342d2a555e45cb256ed9f1401104c8

SHA256
55a7aa311173e2a86f607102fa9943b6d0b209c47c875fea3bccb69d54bf966b

SHA512
4fe2a9dde61154fc21b5caa93f73c7f4c3e4efd88e3a83c876c592a65d46fccb2b2253f69ad1b9e0e77ac25639af68b29e10cd8bd8c7f0e7240105bccb044f6e

Download Submit
memory/1256-4-0x0000000002130000-0x0000000002145000-memory.dmp

Filesize
84KB

Download
memory/1256-16-0x0000000002690000-0x00000000026A5000-memory.dmp

Filesize
84KB

Download
memory/1340-14-0x00000000017B0000-0x00000000018B0000-memory.dmp

Filesize
1024KB

Download
memory/1340-15-0x0000000000400000-0x00000000016C8000-memory.dmp

Filesize
18.8MB

Download
memory/1340-17-0x0000000000400000-0x00000000016C8000-memory.dmp

Filesize
18.8MB

Download
memory/2900-1-0x0000000001810000-0x0000000001910000-memory.dmp

Filesize
1024KB

Download
memory/2900-2-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2900-3-0x0000000000400000-0x00000000016C8000-memory.dmp

Filesize
18.8MB

Download
memory/2900-5-0x0000000000400000-0x00000000016C8000-memory.dmp

Filesize
18.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads