smokeloader | bde800ed0a49fc1218bec16d932723c50129f6de01105afaa617bbbab4f30e2e

Analysis

max time kernel
93s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb12a99645d3ede4dcf3c5a0b0120bcb_JaffaCakes118.exe
Size

173KB
MD5

fb12a99645d3ede4dcf3c5a0b0120bcb
SHA1

2bd9fe44567d87f837bbc53efcc6ee9114f172bf
SHA256

bde800ed0a49fc1218bec16d932723c50129f6de01105afaa617bbbab4f30e2e
SHA512

4e51684bd9eb188df3234aed04a31380a635e700a041eedf20f01d5a8761837d763fc71302c019fac443272ddd7d4cb05143f89196678f502c7252ced3a018d7
SSDEEP

3072:jkp4vvgSJ8EvgsprebUGysnTLZsQMBkZnAcfF8EhMqU6zJg/jBQavWH:jc/SG0bpq12XmF8ECP6u/tQavW

Score

10^/10

smokeloader 1337 backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Botnet

1337

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Core1 .NET packer 1 IoCs

Detects packer/loader used by .NET malware.

resource	yara_rule
behavioral2/memory/1944-3-0x00000000010A0000-0x00000000010C2000-memory.dmp	Core1

Loads dropped DLL 1 IoCs

pid	Process
1508	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\patchidm.exe = "C:\\Users\\Admin\\AppData\\Roaming\\patchidm.exe"	fb12a99645d3ede4dcf3c5a0b0120bcb_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 1508	1944	fb12a99645d3ede4dcf3c5a0b0120bcb_JaffaCakes118.exe	82

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svchost.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1508	1944	fb12a99645d3ede4dcf3c5a0b0120bcb_JaffaCakes118.exe	82
PID 1944 wrote to memory of 1508	1944	fb12a99645d3ede4dcf3c5a0b0120bcb_JaffaCakes118.exe	82
PID 1944 wrote to memory of 1508	1944	fb12a99645d3ede4dcf3c5a0b0120bcb_JaffaCakes118.exe	82
PID 1944 wrote to memory of 1508	1944	fb12a99645d3ede4dcf3c5a0b0120bcb_JaffaCakes118.exe	82
PID 1944 wrote to memory of 1508	1944	fb12a99645d3ede4dcf3c5a0b0120bcb_JaffaCakes118.exe	82
PID 1944 wrote to memory of 1508	1944	fb12a99645d3ede4dcf3c5a0b0120bcb_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\fb12a99645d3ede4dcf3c5a0b0120bcb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb12a99645d3ede4dcf3c5a0b0120bcb_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWow64\svchost.exe
  "C:\\Windows\\SysWow64\\svchost.exe"
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D8E6.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
memory/1508-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1508-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1508-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1944-3-0x00000000010A0000-0x00000000010C2000-memory.dmp

Filesize
136KB

Download
memory/1944-5-0x00000000010D0000-0x00000000010E6000-memory.dmp

Filesize
88KB

Download
memory/1944-6-0x00007FFEDCE20000-0x00007FFEDD8E1000-memory.dmp

Filesize
10.8MB

Download
memory/1944-7-0x00000000010F0000-0x00000000010F4000-memory.dmp

Filesize
16KB

Download
memory/1944-4-0x00000000010D0000-0x00000000010DA000-memory.dmp

Filesize
40KB

Download
memory/1944-0-0x00007FFEDCE23000-0x00007FFEDCE25000-memory.dmp

Filesize
8KB

Download
memory/1944-2-0x0000000001080000-0x00000000010A2000-memory.dmp

Filesize
136KB

Download
memory/1944-1-0x00000000002B0000-0x00000000002E0000-memory.dmp

Filesize
192KB

Download
memory/1944-17-0x00007FFEDCE20000-0x00007FFEDD8E1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads