smokeloader | e0bf1e5cac112a645c59f89a98a6001a6ab3b03acb4cd588018c737a169c42a2 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-10-2024 22:12

Sharing

Report Analysis Logs

General

Target

6c17569594b13e237037d65bee0bf3be_JaffaCakes118.exe
Size

179KB
MD5

6c17569594b13e237037d65bee0bf3be
SHA1

7d7425e9aa0b40ce337fec29046bf7353f7dceac
SHA256

e0bf1e5cac112a645c59f89a98a6001a6ab3b03acb4cd588018c737a169c42a2
SHA512

cfe4701f2dee2c6613fc785b95e3715749e5ecfad4afca64ee72c8685224952bd82d7fbe725fcc7f693e6e92a6880bca12f5dd06a031a5105b488266d4b3e6de
SSDEEP

3072:IDUh0JwjkUyFcy/NILs+BgCvB2rcPI1ZeCrY8EuSzQz:IDUGwj7yGy1Ms+BAcPI1NcuSzC

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

C:\Users\Admin\AppData\Local\Temp\6c17569594b13e237037d65bee0bf3be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6c17569594b13e237037d65bee0bf3be_JaffaCakes118.exe"
1⤵
PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-2-0x00000000005A0000-0x00000000006A0000-memory.dmp

Filesize
1024KB

Download
memory/2860-4-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2860-1-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2860-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2860-5-0x00000000005A0000-0x00000000006A0000-memory.dmp

Filesize
1024KB

Download