Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2024 06:27

General

  • Target

    JaffaCakes118_57a884e3676b83fc67b8841f323323328f48769b33f36b0dc0ff16ec6325ce96.exe

  • Size

    345KB

  • MD5

    09b34a896ceda160c3b6db196277f0ee

  • SHA1

    f61d17e796c66914c1d8784cac5fe08fea46887c

  • SHA256

    57a884e3676b83fc67b8841f323323328f48769b33f36b0dc0ff16ec6325ce96

  • SHA512

    be397ce4024309e61a3e9e172cff19ffc27aba3d90542f80f821b8e9e4de4e4579e8ca39db63a4c5b71ad9e9caed95613259f6038ea10bc43c86e08f89b9cd72

  • SSDEEP

    6144:iBIXCyGfOp1KieRTSbOyfQzk7tZgSOkvK9:iBxOuieRsOyfQzk4STy9

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Smokeloader family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57a884e3676b83fc67b8841f323323328f48769b33f36b0dc0ff16ec6325ce96.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57a884e3676b83fc67b8841f323323328f48769b33f36b0dc0ff16ec6325ce96.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57a884e3676b83fc67b8841f323323328f48769b33f36b0dc0ff16ec6325ce96.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57a884e3676b83fc67b8841f323323328f48769b33f36b0dc0ff16ec6325ce96.exe"
      2⤵
        PID:2776

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2652-1-0x00000000004E0000-0x00000000005E0000-memory.dmp

      Filesize

      1024KB

    • memory/2652-2-0x0000000000020000-0x0000000000029000-memory.dmp

      Filesize

      36KB

    • memory/2776-6-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2776-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2776-9-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2776-7-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.