Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 09:52
Static task
static1
Behavioral task
behavioral1
Sample
7e1b085263a1735851f164cdfe697228.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
7e1b085263a1735851f164cdfe697228.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
7e1b085263a1735851f164cdfe697228.exe
-
Size
226KB
-
MD5
7e1b085263a1735851f164cdfe697228
-
SHA1
d87cd6bf183ae379c5fb1caccd6e2627d2129a2b
-
SHA256
094e5f284519632fec8516d9c58966c9fdcc1e8e848b39532472ec6906cf2bfe
-
SHA512
0b2a6518e7b9f5938cfc1edba0e63395d95d94fd0d1eb2811f33121202f2d892606fdf5b21dbf06ab56fccf5e2c978d864be9817d87947bbe0cc4f80088270ae
-
SSDEEP
3072:kzd/XR5oQOWIpUGXAJIIAE6FxW0YyqVpF4DTIbBkOAg0Fujxh+iZj8lY9454jCBz:W/XyWVGXsIxE6K0uVpFjXAOv+iZje56e
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
wood
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3044 set thread context of 2764 3044 7e1b085263a1735851f164cdfe697228.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e1b085263a1735851f164cdfe697228.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe Token: SeLoadDriverPrivilege 3044 7e1b085263a1735851f164cdfe697228.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2764 3044 7e1b085263a1735851f164cdfe697228.exe 31 PID 3044 wrote to memory of 2764 3044 7e1b085263a1735851f164cdfe697228.exe 31 PID 3044 wrote to memory of 2764 3044 7e1b085263a1735851f164cdfe697228.exe 31 PID 3044 wrote to memory of 2764 3044 7e1b085263a1735851f164cdfe697228.exe 31 PID 3044 wrote to memory of 2764 3044 7e1b085263a1735851f164cdfe697228.exe 31 PID 3044 wrote to memory of 2764 3044 7e1b085263a1735851f164cdfe697228.exe 31 PID 3044 wrote to memory of 2764 3044 7e1b085263a1735851f164cdfe697228.exe 31 PID 3044 wrote to memory of 2764 3044 7e1b085263a1735851f164cdfe697228.exe 31 PID 3044 wrote to memory of 2764 3044 7e1b085263a1735851f164cdfe697228.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e1b085263a1735851f164cdfe697228.exe"C:\Users\Admin\AppData\Local\Temp\7e1b085263a1735851f164cdfe697228.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2764
-