Analysis

  • max time kernel
    16s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    15-12-2024 14:14

General

  • Target

    07523a9d4656e566c37f787bcf15a1a539e41fe5ed40b5b77865b484a1d87d68.exe

  • Size

    252KB

  • MD5

    13aef0c6305d9c17e4ad0ba7007fbab6

  • SHA1

    7c9866189996a90114fdd6e3a74efd847276ffa8

  • SHA256

    07523a9d4656e566c37f787bcf15a1a539e41fe5ed40b5b77865b484a1d87d68

  • SHA512

    35b19a5f791d8ffe18919622f0cbf96a83ba57e7bd337f3287c2b00eef1e90913ced533609be8ac448e5a71ca8e8e27d0a4710f75a3fe55da63219da1fe9bdfc

  • SSDEEP

    3072:GZeGlWSnL9evCCV1SHTaCJbAIYImxhtAjAcsxkgaBChUpZa9uD6Vdyhk:RGsa9evCCVIH2CFcD9mA5iga3wVf

Malware Config

Extracted

Family

smokeloader

Botnet

0009

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Smokeloader family
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07523a9d4656e566c37f787bcf15a1a539e41fe5ed40b5b77865b484a1d87d68.exe
    "C:\Users\Admin\AppData\Local\Temp\07523a9d4656e566c37f787bcf15a1a539e41fe5ed40b5b77865b484a1d87d68.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 140
      2⤵
      • Program crash
      PID:2248

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/848-1-0x0000000002CB0000-0x0000000002DB0000-memory.dmp

    Filesize

    1024KB

  • memory/848-2-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/848-3-0x0000000000400000-0x0000000002B5B000-memory.dmp

    Filesize

    39.4MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.