smokeloader | ee842be31f5e8f97854085a6f5802c11031bb279fe621c5f7a817b65f7e1d701

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09/10/2023, 01:18

Target

4012-1-0x0000000000400000-0x0000000000409000-memory.exe
Size

36KB
MD5

2e08224703a5812c9d8fe823f274a0f2
SHA1

75ee798c5712a98efa8e4f57bf860f66d55831ab
SHA256

ee842be31f5e8f97854085a6f5802c11031bb279fe621c5f7a817b65f7e1d701
SHA512

fedeecc496de299f14a19cedd97f3b5b6853a6cc4154d7530e1ecf7ff9721b4c6dedda8946784e53f98c36c394b32d3203442e989de20867f650db33252e4fe7
SSDEEP

384:K9VD6tee+qUOTd2opGIVXLcdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYD:k6Qe+qUv8ecqdvOXA6XkPslJvGaVW

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1192	1732	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1192	1732	4012-1-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 1732 wrote to memory of 1192	1732	4012-1-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 1732 wrote to memory of 1192	1732	4012-1-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 1732 wrote to memory of 1192	1732	4012-1-0x0000000000400000-0x0000000000409000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\4012-1-0x0000000000400000-0x0000000000409000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4012-1-0x0000000000400000-0x0000000000409000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 36
  2⤵
  - Program crash
  PID:1192

memory/1732-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download