Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
08/04/2026, 04:35
General
- Target 2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
- Size 452KB
- Sample260408-e724sag13p
- SHA256 185b3209d62df291d9c2fba52639c07a041ab30ad82e8deb914551eb273b6832
Malware Config
Extracted
-
smokeloader
-
pub4
Extracted
-
smokeloader
-
2022
-
http://aapu.at/tmp/
-
http://poudineh.com/tmp/
-
http://firsttrusteedrx.ru/tmp/
-
http://kingpirate.ru/tmp/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Smokeloader family
- Deletes itself 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3212-3-0x0000000000C90000-0x0000000000CA6000-memory.dmp
memory/3212-9-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/3212-8-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-7-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-11-0x00007FFB79192000-0x00007FFB79193000-memory.dmp
memory/3212-10-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-12-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-14-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-13-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-16-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-18-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-19-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-17-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-15-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-20-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-22-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-27-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-26-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-25-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-24-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-23-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-21-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-29-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-30-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-34-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-33-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-35-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-31-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-32-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-28-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-39-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-40-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/3212-42-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/3212-48-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-49-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-50-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-52-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-51-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-53-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-56-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-55-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-57-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-54-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-58-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-59-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-61-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-60-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-66-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-65-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-64-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-63-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-62-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-67-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-69-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-68-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-71-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-70-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-75-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-74-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-73-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-72-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-76-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-77-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-78-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-80-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-81-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-79-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-82-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-83-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-86-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-85-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-84-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-87-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-88-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-89-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-90-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-95-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-94-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-93-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-92-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-91-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-96-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-97-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-100-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-102-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-101-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-99-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-103-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-98-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-104-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-105-0x00007FFB790F0000-0x00007FFB791F7000-memory.dmp
memory/3212-106-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-107-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-108-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-111-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-109-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-110-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-112-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-113-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-117-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-116-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-115-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-114-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-118-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/3212-119-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/4756-1-0x0000000002E20000-0x0000000002F20000-memory.dmp
memory/4756-2-0x0000000002E00000-0x0000000002E09000-memory.dmp