Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08-11-2024 12:27
Static task
static1
Behavioral task
behavioral1
Sample
74f1512720df1bd270a3c350ecbc5340.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
74f1512720df1bd270a3c350ecbc5340.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
74f1512720df1bd270a3c350ecbc5340.exe
-
Size
226KB
-
MD5
74f1512720df1bd270a3c350ecbc5340
-
SHA1
1f5cbdf8ab67aaf2671738ad558d425d7d43a689
-
SHA256
ae39fe33549b1fbd59e82e1a0d9c30dd9699e3fd16574a7ea4c3deb56868707e
-
SHA512
fc4c947f5e4e8312ea840c7470c66f212a2d92314c353bc55381903c0efb9e4aecd75f4b45f49028735bc99c6a6302de1fb0393e8961cac6af7cee8fa2555e60
-
SSDEEP
3072:9zt1HXbuI+u+D0ktAJMgA6UFHW0UGCXZR2DTIbBkOAg0Fuj3fFCYIB5pwgHc8dbM:31LIu5ktsMZ6UQ0KXZRdXAOLFewmD56P
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
wood
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
74f1512720df1bd270a3c350ecbc5340.exedescription pid Process procid_target PID 3060 set thread context of 1568 3060 74f1512720df1bd270a3c350ecbc5340.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
74f1512720df1bd270a3c350ecbc5340.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74f1512720df1bd270a3c350ecbc5340.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
74f1512720df1bd270a3c350ecbc5340.exedescription pid Process Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe Token: SeLoadDriverPrivilege 3060 74f1512720df1bd270a3c350ecbc5340.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
74f1512720df1bd270a3c350ecbc5340.exedescription pid Process procid_target PID 3060 wrote to memory of 2148 3060 74f1512720df1bd270a3c350ecbc5340.exe 31 PID 3060 wrote to memory of 2148 3060 74f1512720df1bd270a3c350ecbc5340.exe 31 PID 3060 wrote to memory of 2148 3060 74f1512720df1bd270a3c350ecbc5340.exe 31 PID 3060 wrote to memory of 2148 3060 74f1512720df1bd270a3c350ecbc5340.exe 31 PID 3060 wrote to memory of 2148 3060 74f1512720df1bd270a3c350ecbc5340.exe 31 PID 3060 wrote to memory of 2148 3060 74f1512720df1bd270a3c350ecbc5340.exe 31 PID 3060 wrote to memory of 2148 3060 74f1512720df1bd270a3c350ecbc5340.exe 31 PID 3060 wrote to memory of 1568 3060 74f1512720df1bd270a3c350ecbc5340.exe 32 PID 3060 wrote to memory of 1568 3060 74f1512720df1bd270a3c350ecbc5340.exe 32 PID 3060 wrote to memory of 1568 3060 74f1512720df1bd270a3c350ecbc5340.exe 32 PID 3060 wrote to memory of 1568 3060 74f1512720df1bd270a3c350ecbc5340.exe 32 PID 3060 wrote to memory of 1568 3060 74f1512720df1bd270a3c350ecbc5340.exe 32 PID 3060 wrote to memory of 1568 3060 74f1512720df1bd270a3c350ecbc5340.exe 32 PID 3060 wrote to memory of 1568 3060 74f1512720df1bd270a3c350ecbc5340.exe 32 PID 3060 wrote to memory of 1568 3060 74f1512720df1bd270a3c350ecbc5340.exe 32 PID 3060 wrote to memory of 1568 3060 74f1512720df1bd270a3c350ecbc5340.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\74f1512720df1bd270a3c350ecbc5340.exe"C:\Users\Admin\AppData\Local\Temp\74f1512720df1bd270a3c350ecbc5340.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2148
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:1568
-