Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 07:22
Behavioral task
behavioral1
Sample
2492-0-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2492-0-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2492-0-0x0000000000400000-0x000000000040B000-memory.exe
-
Size
44KB
-
MD5
344237978b3143ae0e4c94eebc2b2d9c
-
SHA1
c8ec079900e8410461a395dc02c1f10eef9f806c
-
SHA256
0da7e40c57308b75cdb229c4f2fecdc94862c481c5a0b74ecc3ead2549433dca
-
SHA512
d84ef67181196f70b48a7ea0c476893faa055c9bd869fdadb134339d18459de772cd8bb79df7decfc796f4646c1454a576a79f2d93d1e00a4f588f2473b87a9a
-
SSDEEP
768:aggVGeBsLoEmazQYFqMiM2VAyWq0I8xQh6T/gO0VR:ah0gaMYFJiMjJ3I8xQh6Th0
Malware Config
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Program crash 1 IoCs
pid pid_target Process procid_target 3292 1984 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2492-0-0x0000000000400000-0x000000000040B000-memory.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2492-0-0x0000000000400000-0x000000000040B000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2492-0-0x0000000000400000-0x000000000040B000-memory.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 1842⤵
- Program crash
PID:3292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1984 -ip 19841⤵PID:4624