Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 09:52
Static task
static1
Behavioral task
behavioral1
Sample
4b59735ef6a2a1b87425256235dc923a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4b59735ef6a2a1b87425256235dc923a.exe
Resource
win10v2004-20241007-en
General
-
Target
4b59735ef6a2a1b87425256235dc923a.exe
-
Size
371KB
-
MD5
4b59735ef6a2a1b87425256235dc923a
-
SHA1
4361a3409a9c15aa93f17ae2406fc4b21b73cdea
-
SHA256
49bce5c64ecd75162aef2a9b882b55bb3524a731d5853106cbf191acf946ac47
-
SHA512
90a1941299912e40923270de145b60b25c5c416f1aba9f48efb86e376bc09807f49859231eab3043ab1726b6b88872ac4fbba3bc275ac5d2c01117cd354a3fe9
-
SSDEEP
6144:fDoOyMjLQyI0FrvVhQU3j8h1+BDHcM6++ra9n+:fDow8yILUz8h1aDI+69
Malware Config
Extracted
smokeloader
oct
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Program crash 1 IoCs
pid pid_target Process procid_target 2772 1508 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b59735ef6a2a1b87425256235dc923a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2772 1508 4b59735ef6a2a1b87425256235dc923a.exe 31 PID 1508 wrote to memory of 2772 1508 4b59735ef6a2a1b87425256235dc923a.exe 31 PID 1508 wrote to memory of 2772 1508 4b59735ef6a2a1b87425256235dc923a.exe 31 PID 1508 wrote to memory of 2772 1508 4b59735ef6a2a1b87425256235dc923a.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b59735ef6a2a1b87425256235dc923a.exe"C:\Users\Admin\AppData\Local\Temp\4b59735ef6a2a1b87425256235dc923a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1402⤵
- Program crash
PID:2772
-