smokeloader | 27458d6f30569191f6ecd28b673402eb2422497a7562c42ffa8ee86d6f88e9a4

Analysis

max time kernel
118s
max time network
147s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 21:58

Target

1836-45-0x0000000000400000-0x0000000000409000-memory.exe
Size

36KB
MD5

029371a124ba9f304489c425c494a6a7
SHA1

dfcf0ba42fbf6db6f767632efdf1475d3fe0fef6
SHA256

27458d6f30569191f6ecd28b673402eb2422497a7562c42ffa8ee86d6f88e9a4
SHA512

9f831dbab9827afef118185586a7c74392cd774f18ce6eb9ebb3f684257a8d732ef85039560f7af280613bdbec312be60746e059c077f33566c94591ca24b7bc
SSDEEP

384:K9VD6tee+O2UOTd2opQTR23aaFdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRg:k6Qe+BUv837cqdvOXA6XkPslJvGaVW

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1504	2092	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1504	2092	1836-45-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 2092 wrote to memory of 1504	2092	1836-45-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 2092 wrote to memory of 1504	2092	1836-45-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 2092 wrote to memory of 1504	2092	1836-45-0x0000000000400000-0x0000000000409000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\1836-45-0x0000000000400000-0x0000000000409000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1836-45-0x0000000000400000-0x0000000000409000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 36
  2⤵
  - Program crash
  PID:1504

memory/2092-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download