Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-11-2024 15:10

General

  • Target

    1720-3-0x0000000000400000-0x000000000040B000-memory.exe

  • Size

    44KB

  • MD5

    5350b121281f5934e9b994506338160d

  • SHA1

    f8b9e153c87d5fe5d5b5079566fbecf106ddbfe3

  • SHA256

    012aa8216179dfb1b5b4bb1c3be7faa0d601552e58318041b0a2282dd7bbc48f

  • SHA512

    2cb83c7bd5d13ad3e90927a878f964be68330075081202649b23d4da51235a116685e31148df4d778b79da1ff127d76b4011cbf669be26fd0884a51c7ef09eaa

  • SSDEEP

    768:LaFq5EYVkNuZNe3moyGali+xP1Ux+v/RN:LaEzbXCXyRJxk6j

Malware Config

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Smokeloader family
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1720-3-0x0000000000400000-0x000000000040B000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\1720-3-0x0000000000400000-0x000000000040B000-memory.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3396
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 224
      2⤵
      • Program crash
      PID:3460
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3396 -ip 3396
    1⤵
      PID:2640

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3396-0-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB