Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
12/12/2025, 01:50
General
- Target 2025-12-11_7009a6dfc4e25123b7a728e39296fd30_elex_smoke-loader.exe
- Size 3.0MB
- Sample251212-b9cecsap8t
- SHA256 4f61c2b9e812e9b7991d4a8a427bd139b117757560492f40f7bdefa73749548e
Malware Config
Signatures
- Banload
Banload variants download malicious files, then install and execute the files.
- Banload family
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 9 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-12-11_7009a6dfc4e25123b7a728e39296fd30_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-12-11_7009a6dfc4e25123b7a728e39296fd30_elex_smoke-loader.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -k2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3200-31-0x0000000000400000-0x00000000008E1000-memory.dmp
memory/3200-2-0x0000000000698000-0x0000000000699000-memory.dmp
memory/3200-3-0x0000000002B90000-0x0000000002D90000-memory.dmp
memory/3200-9-0x0000000002B90000-0x0000000002D90000-memory.dmp
memory/3200-12-0x0000000000400000-0x00000000008E1000-memory.dmp
memory/3200-13-0x0000000000400000-0x00000000008E1000-memory.dmp
memory/3200-15-0x0000000000400000-0x00000000008E1000-memory.dmp
memory/3200-18-0x0000000002B90000-0x0000000002D90000-memory.dmp
memory/3200-16-0x0000000000400000-0x00000000008E1000-memory.dmp
memory/3200-17-0x0000000000400000-0x00000000008E1000-memory.dmp
memory/3200-19-0x0000000002B90000-0x0000000002D90000-memory.dmp
memory/3200-0-0x0000000000400000-0x00000000008E1000-memory.dmp
memory/3200-27-0x0000000002B90000-0x0000000002D90000-memory.dmp
memory/3576-33-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-44-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-24-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-30-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-23-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-22-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-26-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-21-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-55-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-53-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-51-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-50-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-49-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-47-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-46-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-29-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-43-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-41-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-39-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-38-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-36-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-35-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-52-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-48-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-45-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-42-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-40-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-37-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-34-0x0000000000400000-0x000000000050F000-memory.dmp
memory/3576-32-0x0000000000400000-0x000000000050F000-memory.dmp