Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 05:39
Static task
static1
Behavioral task
behavioral1
Sample
afc14ac5145b194773b3ae0522b4df3e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
afc14ac5145b194773b3ae0522b4df3e.exe
Resource
win10v2004-20241007-en
General
-
Target
afc14ac5145b194773b3ae0522b4df3e.exe
-
Size
278KB
-
MD5
afc14ac5145b194773b3ae0522b4df3e
-
SHA1
a0400fbb268c3cd6c516a5aadec05ce9d7fda785
-
SHA256
2ba67b8162e3730dd3bcd6d5eb2fbfe5477935b769da310eaa494e009d54c7da
-
SHA512
44cde5eb20fd107a7e2864a2f5a67e4f4e752ab4c0b1157ef5c9e39658d6be1ff8d98cbd74df7a0503b5e19eb07285eefbb8a8c17b0b0b6b67add5d72878b21e
-
SSDEEP
6144:o6DzZwAPif8ZkTXygfOnj15QgwEneG0yl8O/B:7/ZwB8eTXygfOnrQgwEeG0vqB
Malware Config
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Program crash 1 IoCs
pid pid_target Process procid_target 2308 2984 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language afc14ac5145b194773b3ae0522b4df3e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2308 2984 afc14ac5145b194773b3ae0522b4df3e.exe 30 PID 2984 wrote to memory of 2308 2984 afc14ac5145b194773b3ae0522b4df3e.exe 30 PID 2984 wrote to memory of 2308 2984 afc14ac5145b194773b3ae0522b4df3e.exe 30 PID 2984 wrote to memory of 2308 2984 afc14ac5145b194773b3ae0522b4df3e.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\afc14ac5145b194773b3ae0522b4df3e.exe"C:\Users\Admin\AppData\Local\Temp\afc14ac5145b194773b3ae0522b4df3e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1362⤵
- Program crash
PID:2308
-