smokeloader | 450ea520de495c23e7196be6a26f25e58d205ce7a84b19cb975163858de5a834

Analysis

max time kernel
13s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 14:15

Target

2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe
Size

254KB
MD5

9cbb1bf76d4c63f9a0eb785ee8ba899a
SHA1

565bef714b0e5693db500c24091b2446e2420b4b
SHA256

2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18
SHA512

4921ea5d2c2d85a962c664a7dafc461d96962a33c5645cb466514087b439f339a83d1cd3cd10ff28e97c0f6a73eddeedbd9c634e949b5786caa89bbe7423558f
SSDEEP

6144:LVD2Lr/V90d2WxjV/hAOjLIuhZM61oPGCV:LELr/E7p0uT2GCV

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4756 set thread context of 868	4756	2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe	86

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 1780	4756	2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe	85
PID 4756 wrote to memory of 1780	4756	2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe	85
PID 4756 wrote to memory of 1780	4756	2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe	85
PID 4756 wrote to memory of 868	4756	2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe	86
PID 4756 wrote to memory of 868	4756	2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe	86
PID 4756 wrote to memory of 868	4756	2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe	86
PID 4756 wrote to memory of 868	4756	2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe	86
PID 4756 wrote to memory of 868	4756	2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe	86
PID 4756 wrote to memory of 868	4756	2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe	86

C:\Users\Admin\AppData\Local\Temp\2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe
"C:\Users\Admin\AppData\Local\Temp\2aef4f628f2c88be0693462366cc35c7148d9fbccdd842a43be1c536af20fe18.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1780
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:868

memory/868-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download