smokeloader | deb7a19309142624655ecf1268022a780fc208552e84eae7ef41b126d74f5a68

Analysis

max time kernel
141s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fa48fc26da77a9df1c6a79e7eed9f85_JaffaCakes118.exe
Size 117KB
Sample240602-2cca7sac94
SHA256 deb7a19309142624655ecf1268022a780fc208552e84eae7ef41b126d74f5a68
MD5 8fa48fc26da77a9df1c6a79e7eed9f85
SHA1 5ee97cc4cf36682b7d4c1ad504426a28451aed60
SHA512 431e70de9c422f71930c64a02accd88d7c2c85fd6f68872970e6115a7a16a18e079a55f2060e0d3f1869e984957d09801d1a50500445b130f4311a8aed3b6c80
SSDEEP 1536:QnLemcIrvm5d5c6xQ+beFLeBB9vtNVQ2ibxzQN:4rpkeMdQ2iN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2018

http://andersenavoidably.bid/
http://cindyarrest.bid/
http://armoringchildlessnesss.bid/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	8fa48fc26da77a9df1c6a79e7eed9f85_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	8fa48fc26da77a9df1c6a79e7eed9f85_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4900	8fa48fc26da77a9df1c6a79e7eed9f85_JaffaCakes118.exe
4900	8fa48fc26da77a9df1c6a79e7eed9f85_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8fa48fc26da77a9df1c6a79e7eed9f85_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8fa48fc26da77a9df1c6a79e7eed9f85_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4256,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:8
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3572-5-0x0000000002D60000-0x0000000002D75000-memory.dmp

Download

memory/3572-4-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/3572-9-0x0000000002D60000-0x0000000002D75000-memory.dmp

Download

memory/4900-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4900-3-0x0000000000401000-0x000000000040A000-memory.dmp

Download

memory/4900-2-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/4900-1-0x0000000002090000-0x0000000002091000-memory.dmp

Download

memory/4900-6-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4900-8-0x0000000000401000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads