smokeloader | ab5dc688174744c554ee6e18c6274984cdc177abda6eb43fcfdd19a6aefa4637

General

Target

e4c7ac3ddd262c88fbfc28b59da1676e_JaffaCakes118.exe
Size

277KB
MD5

e4c7ac3ddd262c88fbfc28b59da1676e
SHA1

0328a33c0dc21bc38efe195f57f489418fa7e14e
SHA256

ab5dc688174744c554ee6e18c6274984cdc177abda6eb43fcfdd19a6aefa4637
SHA512

4ad94f30a9772c337c7282ec857b949b1a55c33c504bf8bccc9dd9a3b71d8524c491b8cc91f233a6cd8bd43385e4959dde520998fff549901b6d0c0f57f3b158
SSDEEP

6144:yQ1sZJcAGA+yyMOaK9ytbyTEHrCI7Dzk28ZgM3c:QiAG/yyaK9yk+WIDkJE

Score

10^/10

smokeloader pub2 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Deletes itself 1 IoCs

Processes:

pid process

1456
Executes dropped EXE 1 IoCs

Processes:

grfrbgb

pid process

2620 grfrbgb

pid	process
1456

pid	process
2620	grfrbgb

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e4c7ac3ddd262c88fbfc28b59da1676e_JaffaCakes118.exegrfrbgb

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e4c7ac3ddd262c88fbfc28b59da1676e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	grfrbgb
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	grfrbgb
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	grfrbgb
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e4c7ac3ddd262c88fbfc28b59da1676e_JaffaCakes118.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e4c7ac3ddd262c88fbfc28b59da1676e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e4c7ac3ddd262c88fbfc28b59da1676e_JaffaCakes118.exe

pid	process
2032	e4c7ac3ddd262c88fbfc28b59da1676e_JaffaCakes118.exe
2032	e4c7ac3ddd262c88fbfc28b59da1676e_JaffaCakes118.exe
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456
1456

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

e4c7ac3ddd262c88fbfc28b59da1676e_JaffaCakes118.exegrfrbgb

pid process

2032 e4c7ac3ddd262c88fbfc28b59da1676e_JaffaCakes118.exe
2620 grfrbgb

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2892 wrote to memory of 2620	2892	taskeng.exe	grfrbgb
PID 2892 wrote to memory of 2620	2892	taskeng.exe	grfrbgb
PID 2892 wrote to memory of 2620	2892	taskeng.exe	grfrbgb
PID 2892 wrote to memory of 2620	2892	taskeng.exe	grfrbgb

C:\Users\Admin\AppData\Local\Temp\e4c7ac3ddd262c88fbfc28b59da1676e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e4c7ac3ddd262c88fbfc28b59da1676e_JaffaCakes118.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2032

C:\Windows\system32\taskeng.exe
taskeng.exe {82D36A8A-7AB0-4EA8-BA0E-1F21D46A3595} S-1-5-21-2461186416-2307104501-1787948496-1000:MGILJUBR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2892

C:\Users\Admin\AppData\Roaming\grfrbgb
C:\Users\Admin\AppData\Roaming\grfrbgb
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2620

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\grfrbgb
Filesize
277KB

MD5
e4c7ac3ddd262c88fbfc28b59da1676e

SHA1
0328a33c0dc21bc38efe195f57f489418fa7e14e

SHA256
ab5dc688174744c554ee6e18c6274984cdc177abda6eb43fcfdd19a6aefa4637

SHA512
4ad94f30a9772c337c7282ec857b949b1a55c33c504bf8bccc9dd9a3b71d8524c491b8cc91f233a6cd8bd43385e4959dde520998fff549901b6d0c0f57f3b158

Download Submit
memory/1456-4-0x0000000002240000-0x0000000002256000-memory.dmp

Filesize
88KB

Download
memory/1456-16-0x0000000002280000-0x0000000002296000-memory.dmp

Filesize
88KB

Download
memory/2032-2-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/2032-1-0x0000000002810000-0x0000000002910000-memory.dmp

Filesize
1024KB

Download
memory/2032-3-0x0000000000400000-0x00000000023AF000-memory.dmp

Filesize
31.7MB

Download
memory/2032-5-0x0000000000400000-0x00000000023AF000-memory.dmp

Filesize
31.7MB

Download
memory/2620-14-0x0000000002480000-0x0000000002580000-memory.dmp

Filesize
1024KB

Download
memory/2620-15-0x0000000000400000-0x00000000023AF000-memory.dmp

Filesize
31.7MB

Download
memory/2620-17-0x0000000000400000-0x00000000023AF000-memory.dmp

Filesize
31.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads