smokeloader | 25b88bdfb885767a118e031a1f8e3be351006da22d96ac4894c553390fefd092

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25b88bdfb885767a118e031a1f8e3be351006da22d96ac4894c553390fefd092.exe
Size

37KB
MD5

51aa45c5158e3845b97c346c9da0e3f3
SHA1

3609026eb95e2b9eb890c126f88ab229a98ba93b
SHA256

25b88bdfb885767a118e031a1f8e3be351006da22d96ac4894c553390fefd092
SHA512

d001de97bedbf0096256d063b286ac1c1c678f67c5823935c4429ac2446decbc49a58c3f22ac847623edc08fdc6e155df987891222c2911d587884c81e17b6e2
SSDEEP

768:CazBIa4ueiy5prhFvY9NSiNUzhHzp587z78Lj946ZYlueKZN:tguWrqSiN2lz/e7kcueKZN

Score

10^/10

smokeloader pub4 backdoor discovery trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25b88bdfb885767a118e031a1f8e3be351006da22d96ac4894c553390fefd092.exe

C:\Users\Admin\AppData\Local\Temp\25b88bdfb885767a118e031a1f8e3be351006da22d96ac4894c553390fefd092.exe
"C:\Users\Admin\AppData\Local\Temp\25b88bdfb885767a118e031a1f8e3be351006da22d96ac4894c553390fefd092.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4900-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4900-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download