Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 03:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739.exe
- Size 321KB
- Sample260808-dlbt2ayfkh
- SHA256 c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739
- MD5 4d719d38719abe262b054e26681f24e0
- SHA1 de14c06abd0f041fe90f0ff99c234c553119e022
- SHA512 ae670d3b590ce7becfe4c0efc3bcc23191c8665b8758e8f85d290f67e45c256609cf64c32c14651af8b23176376b2e93406d35cdbae92ff61f1f199887a7a4c6
- SSDEEP 6144:3xLOUezL4tYpe1O9xgGq0VvRFBMolz20OaHy:haVzLZpC/0VvR5lzYaS
- TLSH T17E649D12F694B8E1F55ECA318D1EDBDC363EB9504D356F6A326C7A2F29702E0817A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub2
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://mightys.at/tmp/
-
http://mupsin.ru/tmp/
-
http://channelpi.com/tmp/
-
http://mordo.ru/tmp/
rc4.i32
rc4.i32
Signatures
- Family: SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 2500 Process not Found - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 916 c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739.exe 916 c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739.exe 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found 2500 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2500 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 916 c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739.exe - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found Token: SeShutdownPrivilege 2500 Process not Found Token: SeCreatePagefilePrivilege 2500 Process not Found - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process PID 2500 wrote to memory of 4124 2500 Process not Found - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739.exe"C:\Users\Admin\AppData\Local\Temp\c713e47d65d203ba8202f465048c79be0b9ac60526391ec6fb15c9bd50e27739.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:916