Analysis
- user interaction
yes - max time kernel
42s - max time network
44s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 03:31
General
- Target Smothered.exe
- Size 322KB
- Sample260801-d3f53sda29
- SHA256 84796a2f935cdfcd2128c34625102af47780bc538cd7bf4827718e8a3202b1bd
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Smothered.exe"C:\Users\Admin\AppData\Local\Temp\Smothered.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- System policy modification
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3124-0-0x0000000074D42000-0x0000000074D43000-memory.dmp
memory/3124-1-0x0000000000890000-0x00000000008E6000-memory.dmp
memory/3124-2-0x0000000005990000-0x0000000005F4A000-memory.dmp
memory/3124-3-0x0000000005470000-0x0000000005502000-memory.dmp
memory/3124-4-0x0000000074D30000-0x00000000754EC000-memory.dmp
memory/3124-7-0x0000000074D42000-0x0000000074D43000-memory.dmp
memory/3124-8-0x0000000074D30000-0x00000000754EC000-memory.dmp
memory/3124-19-0x0000000006F80000-0x0000000006F90000-memory.dmp
memory/3124-16-0x0000000006F80000-0x0000000006F90000-memory.dmp
memory/3124-17-0x0000000006F80000-0x0000000006F90000-memory.dmp
memory/3124-18-0x0000000074D30000-0x00000000754EC000-memory.dmp
memory/3124-20-0x0000000006F80000-0x0000000006F90000-memory.dmp
memory/3124-21-0x0000000074D30000-0x00000000754EC000-memory.dmp
memory/3124-22-0x0000000074D30000-0x00000000754EC000-memory.dmp
memory/3124-23-0x0000000006F80000-0x0000000006F90000-memory.dmp
memory/3124-24-0x0000000006F80000-0x0000000006F90000-memory.dmp
memory/3124-26-0x0000000074D30000-0x00000000754EC000-memory.dmp