Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 14:02
Static task
static1
Behavioral task
behavioral1
Sample
adc067adbc353993c78fc85d1c2e0650009d0f0589118fdc3834615729e75911.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
adc067adbc353993c78fc85d1c2e0650009d0f0589118fdc3834615729e75911.exe
Resource
win10v2004-20241007-en
General
-
Target
adc067adbc353993c78fc85d1c2e0650009d0f0589118fdc3834615729e75911.exe
-
Size
292KB
-
MD5
a165d686c060665bf433272c93ee7824
-
SHA1
f763124bd014dc0db90c9157cd6030edff9d5a26
-
SHA256
adc067adbc353993c78fc85d1c2e0650009d0f0589118fdc3834615729e75911
-
SHA512
a16e6b66aafcebac21dc4bacf8d854ed1a2884883d51ce519785ccac86f7a0893c83315e63c21feb51eeac14f611364d4f70f9ad8e2ecad930171c32a9daf7fd
-
SSDEEP
6144:RJjr59SUHBxRMD+9PKtkaqnnErQGxoyWPFiM:Px4UhxRMD+EtxqEdH
Malware Config
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Program crash 1 IoCs
pid pid_target Process procid_target 2028 2412 WerFault.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adc067adbc353993c78fc85d1c2e0650009d0f0589118fdc3834615729e75911.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2028 2412 adc067adbc353993c78fc85d1c2e0650009d0f0589118fdc3834615729e75911.exe 29 PID 2412 wrote to memory of 2028 2412 adc067adbc353993c78fc85d1c2e0650009d0f0589118fdc3834615729e75911.exe 29 PID 2412 wrote to memory of 2028 2412 adc067adbc353993c78fc85d1c2e0650009d0f0589118fdc3834615729e75911.exe 29 PID 2412 wrote to memory of 2028 2412 adc067adbc353993c78fc85d1c2e0650009d0f0589118fdc3834615729e75911.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\adc067adbc353993c78fc85d1c2e0650009d0f0589118fdc3834615729e75911.exe"C:\Users\Admin\AppData\Local\Temp\adc067adbc353993c78fc85d1c2e0650009d0f0589118fdc3834615729e75911.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 1362⤵
- Program crash
PID:2028
-