smokeloader | 302945194f1ff6faa74375b03943a4474a1ba9baa33edb3264b83254acb0028a | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 03:36

Sharing

Report Analysis Logs

General

Target

dcd4f60b6912239d0de5ce9f46243063_JaffaCakes118.exe
Size

222KB
MD5

dcd4f60b6912239d0de5ce9f46243063
SHA1

54554ced61ad55b6a4fb2649485186af7a59286c
SHA256

302945194f1ff6faa74375b03943a4474a1ba9baa33edb3264b83254acb0028a
SHA512

d727c9248658c3bc6060fd208831e8be9d5274feffbc97d96b99e736be98ee8a62e96c8ed2f06a251a5e7dbcdb9b8c8545b2dbb1bda070f7b8babe6debf294c8
SSDEEP

3072:vX27n0PT4uliR02dxTsMbAIXei5uY7YWnWnCNeoBKLNts7Yb:vb4utwiMbjedDWWCIwKx

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\dcd4f60b6912239d0de5ce9f46243063_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dcd4f60b6912239d0de5ce9f46243063_JaffaCakes118.exe"
1⤵
PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-1-0x0000000002CE0000-0x0000000002DE0000-memory.dmp

Filesize
1024KB

Download
memory/1672-2-0x00000000002A0000-0x00000000002A9000-memory.dmp

Filesize
36KB

Download
memory/1672-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1672-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1672-5-0x00000000002A0000-0x00000000002A9000-memory.dmp

Filesize
36KB

Download
memory/1672-4-0x0000000000400000-0x0000000002C6D000-memory.dmp

Filesize
40.4MB

Download