Resubmissions

25-01-2025 13:32

250125-qtfjeawpap 10

25-01-2025 13:32

250125-qtdptawpak 10

24-01-2025 13:12

250124-qfz1wszmcs 10

18-01-2025 16:31

250118-t1f1asxqft 10

17-01-2025 20:27

250117-y8gzsasjhw 10

17-01-2025 10:48

250117-mv59nsvlbr 10

Analysis

  • max time kernel
    97s
  • max time network
    126s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    17-01-2025 20:27

General

  • Target

    0di3x.exe

  • Size

    111KB

  • MD5

    bd97f762750d0e38e38d5e8f7363f66a

  • SHA1

    9ae3d7053246289ff908758f9d60d79586f7fc9f

  • SHA256

    d4b767b57f453d599559532d7351feeecd4027b89b0b117552b7a3432ed4a158

  • SHA512

    d0f00c07563aab832b181a7ab93413a93f913f813c83d63c25f4473b7fa2003b4b2a83c97bd9766f9f45a7f2de9e922139a010612f21b15407c9f2bb58a53e39

  • SSDEEP

    1536:4SYTPSLUTRZaEioqsQRPRXplmbH50B+dLDOZrZRzKZvJj5RmLFs8hN:43OLUra1oqxvplQ50BrStJ9RmLFs

Malware Config

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Smokeloader family
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0di3x.exe
    "C:\Users\Admin\AppData\Local\Temp\0di3x.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    PID:604
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 440
      2⤵
      • Program crash
      PID:4184
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 604 -ip 604
    1⤵
      PID:720

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\2F6.tmp

      Filesize

      1.6MB

      MD5

      52db2f93c0c0ecd56c166dd00ab0f5b2

      SHA1

      527141b01e79c0e8e3946cb782d7ad484c8d8019

      SHA256

      3735bc3f50423eb89bcb62948751f63057e70b7eab38570dbfed043877ed5d81

      SHA512

      67d3d9ccfa13a62979dfec74bb91cbf702026f77f5dcf73c539396c1129d46605686d6ba2c855ea3096622421e0d01652d983ac2d950c306dcc168630571178b

    • memory/604-1-0x0000000003210000-0x0000000003310000-memory.dmp

      Filesize

      1024KB

    • memory/604-2-0x00000000001F0000-0x00000000001FA000-memory.dmp

      Filesize

      40KB

    • memory/604-3-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/604-7-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/604-6-0x00000000001F0000-0x00000000001FA000-memory.dmp

      Filesize

      40KB

    • memory/604-5-0x0000000000400000-0x0000000002FA6000-memory.dmp

      Filesize

      43.6MB