smokeloader | c6306e44d7fa39d1e8beb2acfde2a5567a0c8b8b0ef0ef14f921a82b0e5f8807

Analysis

max time kernel
136s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
65e183f999650701e30901b8cf864801_JaffaCakes118.exe
Size 1.1MB
Sample240522-d76arsba5z
SHA256 c6306e44d7fa39d1e8beb2acfde2a5567a0c8b8b0ef0ef14f921a82b0e5f8807
MD5 65e183f999650701e30901b8cf864801
SHA1 cbc51318f370c99f256fc993d8082f4919fe8898
SHA512 e7aac004ee373d12311a252eab57a96644310e6a196712b08dda3584046c1f3880ab7fe28dfd3e5234e6cd02f243b39b1e6723cd7ca43204dffdb02c16ab08b0
SSDEEP 24576:nAHnh+eWsN3skA4RV1Hom2KXMmHauDq+xM0NtFKvyhErE5Wy:ah+ZkldoPK8Yauu+tNtFKQEeX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader 119 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	65e183f999650701e30901b8cf864801_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	65e183f999650701e30901b8cf864801_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 4248	4840	65e183f999650701e30901b8cf864801_JaffaCakes118.exe	95

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	65e183f999650701e30901b8cf864801_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	65e183f999650701e30901b8cf864801_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4248	4840	65e183f999650701e30901b8cf864801_JaffaCakes118.exe	95
PID 4840 wrote to memory of 4248	4840	65e183f999650701e30901b8cf864801_JaffaCakes118.exe	95
PID 4840 wrote to memory of 4248	4840	65e183f999650701e30901b8cf864801_JaffaCakes118.exe	95
PID 4840 wrote to memory of 4248	4840	65e183f999650701e30901b8cf864801_JaffaCakes118.exe	95
PID 4840 wrote to memory of 4248	4840	65e183f999650701e30901b8cf864801_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\65e183f999650701e30901b8cf864801_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65e183f999650701e30901b8cf864801_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\65e183f999650701e30901b8cf864801_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\65e183f999650701e30901b8cf864801_JaffaCakes118.exe"
  2⤵
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4248-0-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4840-3-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads