Analysis
- user interaction
yes - max time kernel
599s - max time network
455s - platform
windows11-21h2_x64 - resource
win11-20260513-es - resource tags
- submitted
17/05/2026, 02:04
General
- Target Smothered.exe
- Size 322KB
- Sample260517-chek3sft2p
- SHA256 84796a2f935cdfcd2128c34625102af47780bc538cd7bf4827718e8a3202b1bd
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Smothered.exe"C:\Users\Admin\AppData\Local\Temp\Smothered.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WMSDKNS.XML.bak
memory/4768-19-0x0000000007720000-0x0000000007730000-memory.dmp
memory/4768-18-0x0000000007720000-0x0000000007730000-memory.dmp
memory/4768-3-0x0000000005C20000-0x0000000005C30000-memory.dmp
memory/4768-4-0x0000000007360000-0x00000000073A0000-memory.dmp
memory/4768-5-0x00000000074B0000-0x00000000075B2000-memory.dmp
memory/4768-1-0x0000000005DF0000-0x0000000006396000-memory.dmp
memory/4768-2-0x00000000058E0000-0x0000000005972000-memory.dmp
memory/4768-21-0x0000000007720000-0x0000000007730000-memory.dmp
memory/4768-17-0x0000000007720000-0x0000000007730000-memory.dmp
memory/4768-20-0x0000000007720000-0x0000000007730000-memory.dmp
memory/4768-0-0x0000000000F20000-0x0000000000F76000-memory.dmp
memory/4768-22-0x0000000007720000-0x0000000007730000-memory.dmp
memory/4768-23-0x0000000007720000-0x0000000007730000-memory.dmp
memory/4768-24-0x0000000007720000-0x0000000007730000-memory.dmp
memory/4768-26-0x0000000005C20000-0x0000000005C30000-memory.dmp