smokeloader | f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53

Analysis

max time kernel
0s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
23-10-2023 19:26

Target

f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe
Size

1.6MB
MD5

9ce90d89c3675dfc667c7fe61a793025
SHA1

9d8f96f00572223430ac27279b95ef4e6106cb09
SHA256

f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53
SHA512

0b75f7adec26482fcbf251a29d46875a2182189746f8676e272f2a0ac91f36096f1e8ce8ad93e812c09bef702c608546e17af4ad248865edff43abc0be1ce13a
SSDEEP

12288:EihhjMAfS5S8a1TxCZG09fEGjQSHC6bELuzzc9X6a9DhvhhHNv/I2:E5AfS5S8a1TyzEGdxE6a9Dhvh5NHI

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4244 set thread context of 1164	4244	f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe	72

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 784	4244	f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe	71
PID 4244 wrote to memory of 784	4244	f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe	71
PID 4244 wrote to memory of 784	4244	f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe	71
PID 4244 wrote to memory of 1164	4244	f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe	72
PID 4244 wrote to memory of 1164	4244	f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe	72
PID 4244 wrote to memory of 1164	4244	f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe	72
PID 4244 wrote to memory of 1164	4244	f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe	72
PID 4244 wrote to memory of 1164	4244	f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe	72
PID 4244 wrote to memory of 1164	4244	f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe	72

C:\Users\Admin\AppData\Local\Temp\f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe
"C:\Users\Admin\AppData\Local\Temp\f65a5f4843cc657539fffb5bd54d31d9441d9ebb29bfc88806b0b7e629598f53.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1164

memory/1164-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download