smokeloader | 64a4451cd02928f64713eda76180ed51914f03a349df777416cc1ea2dfbe1906

Analysis

max time kernel
143s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe
Size

124KB
MD5

61eb45e462738c0e3984137f0a6da5ec
SHA1

82f6201b9f0a77b4298861a1da4cce08b99afb55
SHA256

64a4451cd02928f64713eda76180ed51914f03a349df777416cc1ea2dfbe1906
SHA512

c43aaf6811475f46021ddbabb197c9133c442f17f71f949c1e1b34e532b0c18c9644a931fc6eb9d66e0b666794afa7cb8242c4c974552c514c80b9eb3c99b80b
SSDEEP

3072:zClEDPzAWJJgekoUZXZqXVCAiM3GM+Zs:z8EDPz5LgIUZXZwEAd332

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2018

http://osetr.hk/css/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3152 set thread context of 4360	3152	61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe	87

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4360	61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe
4360	61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3152	61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4360	3152	61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe	87
PID 3152 wrote to memory of 4360	3152	61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe	87
PID 3152 wrote to memory of 4360	3152	61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe	87
PID 3152 wrote to memory of 4360	3152	61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Users\Admin\AppData\Local\Temp\61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\61eb45e462738c0e3984137f0a6da5ec_JaffaCakes118.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious behavior: MapViewOfSection
  PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3152-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3520-3-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3520-2-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/3520-6-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/4360-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download