smokeloader | 483ab7cdc131092363c2c402b326a78c7d212fba00a7c01e0ea5fc99bb76820f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 17:28

Target

763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe
Size

388KB
MD5

763e4269e61dd06332df1d88a5a5206a
SHA1

4ff9cd2fb6c9951176f2546f8ae00ee19bf46668
SHA256

483ab7cdc131092363c2c402b326a78c7d212fba00a7c01e0ea5fc99bb76820f
SHA512

21abaaf33764a5fab563bb03af87e53f4885234e5c7a21b1ad05cddccfa77175e5d87dadc005f2d136aaf47d93da70b2133d09e3b4ff5b484c9a9a61dc4c84a4
SSDEEP

6144:Y5PM8zUqTKOChv0+Be1vTUroDRZf+pffufxWLwn:+9YqOOC10pvTEiR8m6wn

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Loads dropped DLL 1 IoCs

Processes:

763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe

pid process

2724 763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe

pid	process
2724	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe

description	pid	process	target process
PID 1956 set thread context of 2724	1956	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe

description	pid	process	target process
PID 1956 wrote to memory of 2724	1956	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe
PID 1956 wrote to memory of 2724	1956	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe
PID 1956 wrote to memory of 2724	1956	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe
PID 1956 wrote to memory of 2724	1956	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe
PID 1956 wrote to memory of 2724	1956	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe
PID 1956 wrote to memory of 2724	1956	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe
PID 1956 wrote to memory of 2724	1956	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe	763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\763e4269e61dd06332df1d88a5a5206a_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  PID:2724

\Users\Admin\AppData\Local\Temp\BEB8.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
memory/1956-6-0x0000000003730000-0x0000000003830000-memory.dmp

Filesize
1024KB

Download
memory/1956-4-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2724-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2724-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2724-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2724-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download