smokeloader | 1765e5f0ee49b2b6cf4a7361bbaac484f15c6c1d003de02338fffdb615e831d8

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df40ac59f1022b97894abf0582662ff8_JaffaCakes118.exe
Size

920KB
MD5

df40ac59f1022b97894abf0582662ff8
SHA1

98fdf7535a017bea950e9124f5022617b4787f34
SHA256

1765e5f0ee49b2b6cf4a7361bbaac484f15c6c1d003de02338fffdb615e831d8
SHA512

4d5ef29ac454462f5fcb91e27c71949caa36f016edd86d32c5e8a22f9cb86027799fce805cffac9e3b0b4f3d93aa4c412cd34480551ff3e6a9128825416665e7
SSDEEP

3072:AO1LzxGZ9Vag6ujkyamUoo7Or0WpVJTtTDTvDhZmJ8:AO1LsAyjZamroJGJTtTDTvD6J8

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Loads dropped DLL 1 IoCs

pid	Process
2376	df40ac59f1022b97894abf0582662ff8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df40ac59f1022b97894abf0582662ff8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\df40ac59f1022b97894abf0582662ff8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\df40ac59f1022b97894abf0582662ff8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\9A26.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
memory/2376-0-0x0000000000220000-0x0000000000248000-memory.dmp

Filesize
160KB

Download
memory/2376-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2376-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2376-5-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download