Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-11-2024 21:05
Static task
static1
Behavioral task
behavioral1
Sample
1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe
-
Size
226KB
-
MD5
74f1512720df1bd270a3c350ecbc5340
-
SHA1
1f5cbdf8ab67aaf2671738ad558d425d7d43a689
-
SHA256
ae39fe33549b1fbd59e82e1a0d9c30dd9699e3fd16574a7ea4c3deb56868707e
-
SHA512
fc4c947f5e4e8312ea840c7470c66f212a2d92314c353bc55381903c0efb9e4aecd75f4b45f49028735bc99c6a6302de1fb0393e8961cac6af7cee8fa2555e60
-
SSDEEP
3072:9zt1HXbuI+u+D0ktAJMgA6UFHW0UGCXZR2DTIbBkOAg0Fuj3fFCYIB5pwgHc8dbM:31LIu5ktsMZ6UQ0KXZRdXAOLFewmD56P
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
wood
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2400 set thread context of 2696 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe Token: SeLoadDriverPrivilege 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2696 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe 31 PID 2400 wrote to memory of 2696 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe 31 PID 2400 wrote to memory of 2696 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe 31 PID 2400 wrote to memory of 2696 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe 31 PID 2400 wrote to memory of 2696 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe 31 PID 2400 wrote to memory of 2696 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe 31 PID 2400 wrote to memory of 2696 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe 31 PID 2400 wrote to memory of 2696 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe 31 PID 2400 wrote to memory of 2696 2400 1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe"C:\Users\Admin\AppData\Local\Temp\1f5cbdf8ab67aaf2671738ad558d425d7d43a689.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2696
-