Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-11-2024 19:19
Static task
static1
Behavioral task
behavioral1
Sample
b0ef821b4e2203de5adf23723bdba060.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
b0ef821b4e2203de5adf23723bdba060.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
b0ef821b4e2203de5adf23723bdba060.exe
-
Size
226KB
-
MD5
b0ef821b4e2203de5adf23723bdba060
-
SHA1
d769b6bc81c4837a8ef8d88d658772f5ef8d84db
-
SHA256
b4e83bdbab9ee87d0f446a12f8f55e6ea3240104050bd6cac0df51414ed95e14
-
SHA512
bbadf476ac7003e38973b225175652f37ad80c903410e4fd255223547a761bff06d8b7439719ce71634aab16a8a65ae6adceab12b5f5d3a928df603c87998241
-
SSDEEP
3072:UFP/v9qWc+6Y1W8XAJ44AE6Fok0s8YqxPnDTIbBkOAg0FujAQ4S5Oht2q7iNK54s:q/0E6L8Xs4BE6Z0uqxPIXAOwv77iw56w
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
wood
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b0ef821b4e2203de5adf23723bdba060.exedescription pid Process procid_target PID 276 set thread context of 2132 276 b0ef821b4e2203de5adf23723bdba060.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
b0ef821b4e2203de5adf23723bdba060.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b0ef821b4e2203de5adf23723bdba060.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
b0ef821b4e2203de5adf23723bdba060.exedescription pid Process Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe Token: SeLoadDriverPrivilege 276 b0ef821b4e2203de5adf23723bdba060.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
b0ef821b4e2203de5adf23723bdba060.exedescription pid Process procid_target PID 276 wrote to memory of 316 276 b0ef821b4e2203de5adf23723bdba060.exe 32 PID 276 wrote to memory of 316 276 b0ef821b4e2203de5adf23723bdba060.exe 32 PID 276 wrote to memory of 316 276 b0ef821b4e2203de5adf23723bdba060.exe 32 PID 276 wrote to memory of 316 276 b0ef821b4e2203de5adf23723bdba060.exe 32 PID 276 wrote to memory of 316 276 b0ef821b4e2203de5adf23723bdba060.exe 32 PID 276 wrote to memory of 316 276 b0ef821b4e2203de5adf23723bdba060.exe 32 PID 276 wrote to memory of 316 276 b0ef821b4e2203de5adf23723bdba060.exe 32 PID 276 wrote to memory of 2132 276 b0ef821b4e2203de5adf23723bdba060.exe 33 PID 276 wrote to memory of 2132 276 b0ef821b4e2203de5adf23723bdba060.exe 33 PID 276 wrote to memory of 2132 276 b0ef821b4e2203de5adf23723bdba060.exe 33 PID 276 wrote to memory of 2132 276 b0ef821b4e2203de5adf23723bdba060.exe 33 PID 276 wrote to memory of 2132 276 b0ef821b4e2203de5adf23723bdba060.exe 33 PID 276 wrote to memory of 2132 276 b0ef821b4e2203de5adf23723bdba060.exe 33 PID 276 wrote to memory of 2132 276 b0ef821b4e2203de5adf23723bdba060.exe 33 PID 276 wrote to memory of 2132 276 b0ef821b4e2203de5adf23723bdba060.exe 33 PID 276 wrote to memory of 2132 276 b0ef821b4e2203de5adf23723bdba060.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0ef821b4e2203de5adf23723bdba060.exe"C:\Users\Admin\AppData\Local\Temp\b0ef821b4e2203de5adf23723bdba060.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:316
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2132
-