smokeloader | b70da093089d128c92bbdd9bcc6dbbc61ef8e105c05b653c7ad683adaa0f5dd1

Analysis

max time kernel
94s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2624-745-0x0000000000400000-0x000000000040B000-memory.exe
Size

44KB
MD5

48d198ee71aa65caf59b2ca865c62b3a
SHA1

efeecb4fba09c44304aa48898d4b6585b51c646c
SHA256

b70da093089d128c92bbdd9bcc6dbbc61ef8e105c05b653c7ad683adaa0f5dd1
SHA512

c9281b27f7183dc6232e31796eef1f39120197a3adf97de922229b5158c4000ac89b6d6277a3fd668204ea8441ba217340827154e9eaf62cc5ff794820e37e94
SSDEEP

768:BWxb8sAvoT5ehqRvNZnUVKfpLCNN8jlBa3:BWqsGQ5eERvNh5fBCIlA

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5088 3984 WerFault.exe 2624-745-0x0000000000400000-0x000000000040B000-memory.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

2624-745-0x0000000000400000-0x000000000040B000-memory.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2624-745-0x0000000000400000-0x000000000040B000-memory.exe

pid	pid_target	process	target process
5088	3984	WerFault.exe	2624-745-0x0000000000400000-0x000000000040B000-memory.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2624-745-0x0000000000400000-0x000000000040B000-memory.exe

C:\Users\Admin\AppData\Local\Temp\2624-745-0x0000000000400000-0x000000000040B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2624-745-0x0000000000400000-0x000000000040B000-memory.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 224
  2⤵
  - Program crash
  PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3984 -ip 3984
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3984-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download