Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2024 08:16
Static task
static1
Behavioral task
behavioral1
Sample
f5d2704617d33824adfea9476d946a335ac6e3fc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f5d2704617d33824adfea9476d946a335ac6e3fc.exe
Resource
win10v2004-20241007-en
General
-
Target
f5d2704617d33824adfea9476d946a335ac6e3fc.exe
-
Size
361KB
-
MD5
873a639a93c1d19b872141d9572200ba
-
SHA1
f5d2704617d33824adfea9476d946a335ac6e3fc
-
SHA256
1e902df1377fe03cc6d153fe79db192589e68d96d817307856150eb9e98a53ee
-
SHA512
256dc9d35bfd3a220863f777b2355f461cfccdc461a99ef9167334a89b025580ba5fc0113b9be7b2d12b6ee48d3afc100c53a3fd0f68e056f76c6fd07fb553f0
-
SSDEEP
6144:0FOlrWY18VODdR1YGqWnv4ygFdp41hajlttKh4rEZS1ulkYUdlnaRuGrS:jB18VODL1YZWnv4ygFdp41ha3L1ulkbW
Malware Config
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 884 set thread context of 3284 884 f5d2704617d33824adfea9476d946a335ac6e3fc.exe 104 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5d2704617d33824adfea9476d946a335ac6e3fc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI RegSvcs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI RegSvcs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 884 f5d2704617d33824adfea9476d946a335ac6e3fc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 884 wrote to memory of 3284 884 f5d2704617d33824adfea9476d946a335ac6e3fc.exe 104 PID 884 wrote to memory of 3284 884 f5d2704617d33824adfea9476d946a335ac6e3fc.exe 104 PID 884 wrote to memory of 3284 884 f5d2704617d33824adfea9476d946a335ac6e3fc.exe 104 PID 884 wrote to memory of 3284 884 f5d2704617d33824adfea9476d946a335ac6e3fc.exe 104 PID 884 wrote to memory of 3284 884 f5d2704617d33824adfea9476d946a335ac6e3fc.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5d2704617d33824adfea9476d946a335ac6e3fc.exe"C:\Users\Admin\AppData\Local\Temp\f5d2704617d33824adfea9476d946a335ac6e3fc.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Checks SCSI registry key(s)
PID:3284
-