smokeloader | 8e23094f7f41e4186ee1fc154e2af9cb5a4045b0dd41ef6b1e4f13ee532119b0

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21-09-2023 10:36

Target

3668-228-0x0000000000400000-0x0000000000409000-memory.exe
Size

36KB
MD5

ebd08dab8a44c57b181e791f5660d942
SHA1

20a9ccb8582cbbd96b6f46409b949e29d9de6be1
SHA256

8e23094f7f41e4186ee1fc154e2af9cb5a4045b0dd41ef6b1e4f13ee532119b0
SHA512

56dd339112a44a173616034cd58e12b12247c6871ad10c8bb82932124f99992aebdc2db1e7fdee82bab79b0feee06a8645543598684ae542ef0a1fba9c088891
SSDEEP

768:OkUqYDNOIoKpDd1KM02kQhx4hOtFceWzYqvz0bOS:zLiwLKtd1PBkQD4UtFceWnz

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2860	2120	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2860	2120	3668-228-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 2120 wrote to memory of 2860	2120	3668-228-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 2120 wrote to memory of 2860	2120	3668-228-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 2120 wrote to memory of 2860	2120	3668-228-0x0000000000400000-0x0000000000409000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\3668-228-0x0000000000400000-0x0000000000409000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3668-228-0x0000000000400000-0x0000000000409000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 36
  2⤵
  - Program crash
  PID:2860

memory/2120-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download