Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
22/09/2026, 00:42
General
- Target jaffacakes118_45b16bf22905f99151e7e75e546eb4cae740ec7dea991bdf78d02745587c3ce1.exe
- Size 264KB
- Sample260922-a2v13avaqa
- SHA256 45b16bf22905f99151e7e75e546eb4cae740ec7dea991bdf78d02745587c3ce1
Malware Config
Extracted
-
smokeloader
-
pub1
Extracted
-
smokeloader
-
2022
-
http://dpav.cc/tmp/
-
http://lrproduct.ru/tmp/
-
http://kggcp.com/tmp/
-
http://talesofpirates.net/tmp/
-
http://pirateking.online/tmp/
-
http://piratia.pw/tmp/
-
http://go-piratia.ru/tmp/
Signatures
- Family: SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 42 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_45b16bf22905f99151e7e75e546eb4cae740ec7dea991bdf78d02745587c3ce1.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_45b16bf22905f99151e7e75e546eb4cae740ec7dea991bdf78d02745587c3ce1.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3208-3-0x0000000002BC0000-0x0000000002BD6000-memory.dmp
memory/3208-7-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-9-0x0000000002D90000-0x0000000002DA0000-memory.dmp
memory/3208-8-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-11-0x00007FFA699D2000-0x00007FFA699D3000-memory.dmp
memory/3208-10-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-12-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-14-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-15-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-18-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-19-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-17-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-16-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-13-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-22-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-21-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-20-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-26-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-25-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-24-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-23-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-28-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-29-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-33-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-35-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-37-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-36-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-34-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-32-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-31-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-30-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-27-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-38-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-39-0x0000000002D90000-0x0000000002DA0000-memory.dmp
memory/3208-43-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/3208-46-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-47-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-48-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-49-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-51-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-50-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-54-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-56-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-55-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-52-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-53-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-57-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-58-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-59-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-65-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-64-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-63-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-62-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-61-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-60-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-66-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-67-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-68-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-69-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-70-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-71-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-73-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-72-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-74-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-75-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-76-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-79-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-78-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-77-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-80-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-81-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-82-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-83-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-88-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-87-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-86-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-85-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-84-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-89-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-90-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-92-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-91-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-93-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-94-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-95-0x00007FFA69930000-0x00007FFA69A37000-memory.dmp
memory/3208-96-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-97-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-98-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-99-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-100-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-101-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-102-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-107-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-106-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-105-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-104-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-103-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/3208-108-0x0000000002C10000-0x0000000002C20000-memory.dmp
memory/5104-1-0x0000000000A30000-0x0000000000B30000-memory.dmp
memory/5104-2-0x0000000000840000-0x000000000084B000-memory.dmp
memory/5104-4-0x0000000000400000-0x00000000007CB000-memory.dmp