Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    15-12-2024 14:11

General

  • Target

    0adf05dddd6bcabf6436229a527335ea6d2a1eaec96415dbda7613d9fce22fa4.exe

  • Size

    285KB

  • MD5

    e8f6edbfd2f36dbbd6279dda130b646f

  • SHA1

    734f9a6e7ab60745b21054e4691f5ccb45c98d4c

  • SHA256

    0adf05dddd6bcabf6436229a527335ea6d2a1eaec96415dbda7613d9fce22fa4

  • SHA512

    07fea63700736dacdba8281c3660208005f67d050e7ed60e3ecb7151d3022efc29d4e15f3cfe5160f2ced5620c0a807a676012259e3ca3e3445078340003f636

  • SSDEEP

    3072:X6u7Hd75aBj4tT5WiA5EqBY8G5ruUeUlCtHcsS6rjyFSeGuALep8pxOC8vWzZ3bE:XP7Loj2EiRqBPGsCcsoyFiuA7pVf4

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Smokeloader family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0adf05dddd6bcabf6436229a527335ea6d2a1eaec96415dbda7613d9fce22fa4.exe
    "C:\Users\Admin\AppData\Local\Temp\0adf05dddd6bcabf6436229a527335ea6d2a1eaec96415dbda7613d9fce22fa4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Users\Admin\AppData\Local\Temp\0adf05dddd6bcabf6436229a527335ea6d2a1eaec96415dbda7613d9fce22fa4.exe
      "C:\Users\Admin\AppData\Local\Temp\0adf05dddd6bcabf6436229a527335ea6d2a1eaec96415dbda7613d9fce22fa4.exe"
      2⤵
        PID:2700

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1072-5-0x0000000000220000-0x0000000000229000-memory.dmp

      Filesize

      36KB

    • memory/1072-4-0x0000000000A20000-0x0000000000B20000-memory.dmp

      Filesize

      1024KB

    • memory/2700-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2700-7-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2700-6-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2700-3-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2700-8-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB