Analysis
- max time kernel
97s - max time network
103s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
14/05/2025, 05:15
General
- Target 2019-09-02_22-41-10.exe
- Size 251KB
- Sample250514-fx2wpstry2
- SHA256 30f9db1f5838abb6c1580fdfb7f5dcfd7c2ac8cfac50c2edd0c8415d66212c95
Score
10/10
Malware Config
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Smokeloader family
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D47F.tmp
memory/412-1-0x0000000000C30000-0x0000000000D30000-memory.dmp
memory/412-2-0x0000000000B50000-0x0000000000B5B000-memory.dmp
memory/3140-3-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3140-4-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3140-8-0x0000000000400000-0x000000000040A000-memory.dmp