Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
- submitted
17/06/2025, 23:14
General
- Target 0di3x.exe
- Size 111KB
- Sample250617-28f92aspx3
- SHA256 d4b767b57f453d599559532d7351feeecd4027b89b0b117552b7a3432ed4a158
Malware Config
Extracted
-
smokeloader
-
2020
-
http://etasuklavish.today/
-
http://mragyzmachnobesdi.today/
-
http://kimchinikuzims.today/
-
http://slacvostinrius.today/
-
http://straponuliusyn.today/
-
http://grammmdinss.today/
-
http://viprasputinsd.chimkent.su/
-
http://lupadypa.dagestan.su/
-
http://stoknolimchin.exnet.su/
-
http://musaroprovadnikov.live/
-
http://teemforyourexprensiti.life/
-
http://stolkgolmishutich.termez.su/
-
http://roompampamgandish.wtf/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Smokeloader family
- Deletes itself 1 IoCs
- Loads dropped DLL 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0di3x.exe"C:\Users\Admin\AppData\Local\Temp\0di3x.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 3922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1072 -ip 10721⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2F6.tmp
memory/1072-1-0x00000000032F0000-0x00000000033F0000-memory.dmp
memory/1072-2-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1072-7-0x0000000000400000-0x0000000002FA6000-memory.dmp
memory/1072-11-0x0000000000400000-0x0000000002FA6000-memory.dmp
memory/1072-12-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3540-8-0x0000000002980000-0x0000000002996000-memory.dmp
memory/3540-16-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-17-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-18-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-19-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-21-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-20-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-25-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-26-0x0000000002BC0000-0x0000000002BD0000-memory.dmp
memory/3540-24-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-23-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-22-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-29-0x0000000002BC0000-0x0000000002BD0000-memory.dmp
memory/3540-28-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-27-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-37-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-36-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-34-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-33-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-32-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-31-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-30-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-38-0x0000000002BC0000-0x0000000002BD0000-memory.dmp
memory/3540-39-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-40-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-42-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-41-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-43-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-44-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-45-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-46-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-49-0x0000000002BC0000-0x0000000002BD0000-memory.dmp
memory/3540-48-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-47-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-50-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-51-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-52-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-53-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-54-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-56-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-57-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-55-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-58-0x0000000002BC0000-0x0000000002BD0000-memory.dmp
memory/3540-59-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-60-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-61-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-67-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-66-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-64-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-62-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-65-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-68-0x0000000002BC0000-0x0000000002BD0000-memory.dmp
memory/3540-69-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-70-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-72-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-73-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-76-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-75-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-74-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3540-77-0x0000000002BC0000-0x0000000002BD0000-memory.dmp
memory/3540-78-0x0000000002BC0000-0x0000000002BD0000-memory.dmp