Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 04:11
Behavioral task
behavioral1
Sample
ce35282f1644dfefdacbd33213a6974a37a5a3c111200b2f0d1e043a5ec88a0a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ce35282f1644dfefdacbd33213a6974a37a5a3c111200b2f0d1e043a5ec88a0a.exe
Resource
win10v2004-20241007-en
General
-
Target
ce35282f1644dfefdacbd33213a6974a37a5a3c111200b2f0d1e043a5ec88a0a.exe
-
Size
28KB
-
MD5
dbf970cf19ba0378330dec74f86d25a9
-
SHA1
2171c989053ef204425617b318a589354efb8edd
-
SHA256
ce35282f1644dfefdacbd33213a6974a37a5a3c111200b2f0d1e043a5ec88a0a
-
SHA512
673915eb8fcb0844ed10a8cfee28d65b85f8d157b7ba986d2dfe86ba2e54f5db9a73095033201839ecc7d0983fbbed8f0deb63c2b02352b9d88ec5b3e2877415
-
SSDEEP
768:W9F6FTUOWg7rPxGvkKRaRpgXc7lxAX7Eu3B2TO0V5Cbbh9wl:W9cFcg7rPxGMFrgsZxo7vgTrViM
Malware Config
Extracted
smokeloader
555
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ce35282f1644dfefdacbd33213a6974a37a5a3c111200b2f0d1e043a5ec88a0a.exe