Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
09-11-2024 07:24
Static task
static1
Behavioral task
behavioral1
Sample
ca75ed2382bf7b3f7e58cf42641fee91.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
ca75ed2382bf7b3f7e58cf42641fee91.exe
Resource
win10v2004-20241007-en
General
-
Target
ca75ed2382bf7b3f7e58cf42641fee91.exe
-
Size
260KB
-
MD5
ca75ed2382bf7b3f7e58cf42641fee91
-
SHA1
54e0473d29100144bd9590df08af1760bb965285
-
SHA256
d60f19f84e9f7907eb4604caf7a75bf097f23969fcc0ec0e52b2df17197b4729
-
SHA512
c061a4f48e252b2d8e4f96646575b6742f0ca8bf535907330de73b28fa6949c19376b15b94571111182776a3160cc28c17817de1a27c67fd3169a20783f0b465
-
SSDEEP
3072:KX25OPA4p0h+s40ZQsZp45CXj6r+tvR3hOkfdfA91YeP0Kx:qXji+s4mQsZz6r+tKkfB81Ym0S
Malware Config
Extracted
smokeloader
oct
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Program crash 1 IoCs
pid pid_target Process procid_target 2348 2360 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca75ed2382bf7b3f7e58cf42641fee91.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2348 2360 ca75ed2382bf7b3f7e58cf42641fee91.exe 31 PID 2360 wrote to memory of 2348 2360 ca75ed2382bf7b3f7e58cf42641fee91.exe 31 PID 2360 wrote to memory of 2348 2360 ca75ed2382bf7b3f7e58cf42641fee91.exe 31 PID 2360 wrote to memory of 2348 2360 ca75ed2382bf7b3f7e58cf42641fee91.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca75ed2382bf7b3f7e58cf42641fee91.exe"C:\Users\Admin\AppData\Local\Temp\ca75ed2382bf7b3f7e58cf42641fee91.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 1402⤵
- Program crash
PID:2348
-