smokeloader | 835ef4434fd8bd276777771b2bd9f46c112cad61dd22b61ea048a31e4038b23e

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04/08/2023, 17:47

Target

19ec7e29b46db1ea4c210147e253e3c7.exe
Size

39KB
MD5

19ec7e29b46db1ea4c210147e253e3c7
SHA1

50253577597dec8e25cad248ae6f5ed41800a36c
SHA256

835ef4434fd8bd276777771b2bd9f46c112cad61dd22b61ea048a31e4038b23e
SHA512

abeeaa7d8c7ed44b19f3485b87caca7f85500b8fe9bb5f3b87034e4ec247832a28a12b07c949227386ed3eb1103c70e1ae404071ae6163dbf31b7985c022ef3b
SSDEEP

384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW

Score

10^/10

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Deletes itself 1 IoCs

pid	Process
1212	Process not Found

Executes dropped EXE 1 IoCs

pid	Process
1980	fbecrcw

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1212	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1712	19ec7e29b46db1ea4c210147e253e3c7.exe
1980	fbecrcw

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1980	2508	taskeng.exe	31
PID 2508 wrote to memory of 1980	2508	taskeng.exe	31
PID 2508 wrote to memory of 1980	2508	taskeng.exe	31
PID 2508 wrote to memory of 1980	2508	taskeng.exe	31

C:\Windows\system32\taskeng.exe
taskeng.exe {8CEEECDE-FBFB-40D8-9594-4C0123EC8501} S-1-5-21-1024678951-1535676557-2778719785-1000:KDGGTDCU\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Roaming\fbecrcw
  C:\Users\Admin\AppData\Roaming\fbecrcw
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: MapViewOfSection
  PID:1980

C:\Users\Admin\AppData\Roaming\fbecrcw

Filesize
39KB

MD5
19ec7e29b46db1ea4c210147e253e3c7

SHA1
50253577597dec8e25cad248ae6f5ed41800a36c

SHA256
835ef4434fd8bd276777771b2bd9f46c112cad61dd22b61ea048a31e4038b23e

SHA512
abeeaa7d8c7ed44b19f3485b87caca7f85500b8fe9bb5f3b87034e4ec247832a28a12b07c949227386ed3eb1103c70e1ae404071ae6163dbf31b7985c022ef3b

Download Submit
C:\Users\Admin\AppData\Roaming\fbecrcw

Filesize
39KB

MD5
19ec7e29b46db1ea4c210147e253e3c7

SHA1
50253577597dec8e25cad248ae6f5ed41800a36c

SHA256
835ef4434fd8bd276777771b2bd9f46c112cad61dd22b61ea048a31e4038b23e

SHA512
abeeaa7d8c7ed44b19f3485b87caca7f85500b8fe9bb5f3b87034e4ec247832a28a12b07c949227386ed3eb1103c70e1ae404071ae6163dbf31b7985c022ef3b

Download Submit
memory/1212-55-0x0000000002A00000-0x0000000002A16000-memory.dmp

Filesize
88KB

Download
memory/1212-64-0x0000000002A40000-0x0000000002A56000-memory.dmp

Filesize
88KB

Download
memory/1712-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1712-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1980-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download