Overview

overview

10

Static

static

3

e26b4f39f4...18.exe

windows7-x64

10

e26b4f39f4...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-04-2024 11:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e26b4f39f4c64f8f9b4d1d607c1d4450_JaffaCakes118.exe

  • Size

    338KB

  • MD5

    e26b4f39f4c64f8f9b4d1d607c1d4450

  • SHA1

    16d757a87e2d47938cb176465934c3f576929713

  • SHA256

    6ab7801a80f78c2586d0bd611807f3f8229300a32efc7b6793d7b2a8d1d28371

  • SHA512

    80d5ca1afcf515ad4e41e12f5bf39b2a2a58d590bd3e1f3a4814794a7a9c6da9af5a1df77e67c82f74e77f0feeb5b6731ec7d2b7772a2a019c523dc362973cc6

  • SSDEEP

    6144:/hw/KB4AbHmVbIrUgGmvmM+tAVnMPGuZSgDy:s2GtIrUsvGt2nMPGuod

Score
10/10
smokeloaderpub3backdoortrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/
rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e26b4f39f4c64f8f9b4d1d607c1d4450_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e26b4f39f4c64f8f9b4d1d607c1d4450_JaffaCakes118.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4144
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 368
      2⤵
      • Program crash
      PID:2024
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4144 -ip 4144
    1⤵
      PID:4048
    • C:\Users\Admin\AppData\Roaming\ihiwcbs
      C:\Users\Admin\AppData\Roaming\ihiwcbs
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:2360
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 368
        2⤵
        • Program crash
        PID:860
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2360 -ip 2360
      1⤵
        PID:3316

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\ihiwcbs
        Filesize

        338KB

        MD5

        e26b4f39f4c64f8f9b4d1d607c1d4450

        SHA1

        16d757a87e2d47938cb176465934c3f576929713

        SHA256

        6ab7801a80f78c2586d0bd611807f3f8229300a32efc7b6793d7b2a8d1d28371

        SHA512

        80d5ca1afcf515ad4e41e12f5bf39b2a2a58d590bd3e1f3a4814794a7a9c6da9af5a1df77e67c82f74e77f0feeb5b6731ec7d2b7772a2a019c523dc362973cc6

        Download Submit
      • memory/2360-15-0x0000000001830000-0x0000000001930000-memory.dmp
        Filesize

        1024KB

        Download
      • memory/2360-16-0x0000000000400000-0x00000000016C8000-memory.dmp
        Filesize

        18.8MB

        Download
      • memory/2360-20-0x0000000000400000-0x00000000016C8000-memory.dmp
        Filesize

        18.8MB

        Download
      • memory/3476-4-0x0000000001F00000-0x0000000001F15000-memory.dmp
        Filesize

        84KB

        Download
      • memory/3476-17-0x00000000004F0000-0x0000000000505000-memory.dmp
        Filesize

        84KB

        Download
      • memory/4144-1-0x00000000018A0000-0x00000000019A0000-memory.dmp
        Filesize

        1024KB

        Download
      • memory/4144-2-0x0000000001860000-0x0000000001869000-memory.dmp
        Filesize

        36KB

        Download
      • memory/4144-3-0x0000000000400000-0x00000000016C8000-memory.dmp
        Filesize

        18.8MB

        Download
      • memory/4144-7-0x0000000000400000-0x00000000016C8000-memory.dmp
        Filesize

        18.8MB

        Download
      • memory/4144-8-0x0000000001860000-0x0000000001869000-memory.dmp
        Filesize

        36KB

        Download