SmokeLoader

Modular backdoor trojan in use since 2014.

Suspicious use of NtCreateProcessExOtherParentProcess

suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry