smokeloader | 1f91641b76dfc1b3d6ddd9967daf6b50f2aab63240a88d78b317141a71e09ad4

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19/09/2023, 22:17

Target

4860-252-0x0000000000400000-0x0000000000409000-memory.exe
Size

36KB
MD5

04176fc45b910b9df2f8de40afdfdd35
SHA1

451be6c80d1c84fa5b025154a607e3f1936a365e
SHA256

1f91641b76dfc1b3d6ddd9967daf6b50f2aab63240a88d78b317141a71e09ad4
SHA512

1d3666f9aed737e5fab84028bc575edfc6609a83a3c0edb3d2a8fd49a331049aab670c57d8dbf8498d305e09e6e229cdb29fa2c1558d58059aa76f273e625c8c
SSDEEP

768:OkUqYDNDIoKpDd1KM02kQhx4hOtFceWzYqvz0bOS:zLixLKtd1PBkQD4UtFceWnz

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	1744	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2652	1744	4860-252-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 1744 wrote to memory of 2652	1744	4860-252-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 1744 wrote to memory of 2652	1744	4860-252-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 1744 wrote to memory of 2652	1744	4860-252-0x0000000000400000-0x0000000000409000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\4860-252-0x0000000000400000-0x0000000000409000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4860-252-0x0000000000400000-0x0000000000409000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 36
  2⤵
  - Program crash
  PID:2652

memory/1744-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download