Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-en -
resource tags
-
submitted
07-02-2025 09:58
General
-
Target
payload.exe
-
Size
37KB
-
MD5
dafcb6af4224a1f81e65faa087291176
-
SHA1
41fee51a676efdc41009f4f55d9a26c884e7c4ed
-
SHA256
d80fd705f3ff95800961d409d1b78ef3f60a16db259ec26901eba3c131ff3267
-
SHA512
2c6448cf7caf029c9e60ed6203d8eee3d8a869aba8d779bfddc7066cda1dde0641cd0489fe49d32860e4815c3db28a5a234939471469ed52ff44dad914725cdd
-
SSDEEP
768:KYzUlhM+L7oocZXHwsIxgKbc8uU0Ipa9sH+FeEtR2G:ZzUlpewNgUGDR2G
Score
10/10
Malware Config
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\payload.exe"C:\Users\Admin\AppData\Local\Temp\payload.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
-
Filesize
44KB