Overview

overview

10

Static

static

10

df03aa9016...18.exe

windows7-x64

10

df03aa9016...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-09-2024 22:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    df03aa901666b1040b97bda3fe172cc4_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    df03aa901666b1040b97bda3fe172cc4

  • SHA1

    47a361e0fd8ce6964360c42467f99ed80661a952

  • SHA256

    094593979bdab5c68d359b65d896aca5d966d665becc71d800b16a3f2da073e1

  • SHA512

    31ef106c86a90b18e64d72015671f5491575f1de342b161274fb9b5c9d63c41efdd08bab128a4f8e0e9e673d737000f8dfaf410741db5122569a506adad01d7c

  • SSDEEP

    768:GCv9akOt/iIEzj85VFubf1F2/RDyp7oHwzwVIGwnoNHBv+gmT0q:Vv9aJ/OjyPYF2AKQIwnoNE

Score
10/10
smokeloader9998backdoortrojan

Malware Config

Extracted

Family

smokeloader

Botnet

9998

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Loads dropped DLL 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df03aa901666b1040b97bda3fe172cc4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\df03aa901666b1040b97bda3fe172cc4_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\7046.tmp
    Filesize

    1.2MB

    MD5

    d124f55b9393c976963407dff51ffa79

    SHA1

    2c7bbedd79791bfb866898c85b504186db610b5d

    SHA256

    ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

    SHA512

    278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

    Download Submit

  • memory/1780-4-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1780-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download