smokeloader | 8d6ac358e650e5ef96fe746d082920caca02b42e8fbc1d9f89676b666cb31208

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/12/2023, 23:03

Target

856-0-0x0000000000400000-0x0000000000409000-memory.exe
Size

36KB
MD5

6ecac6031bb9a0d0021c098d897e996d
SHA1

49372d1a39f758d6eb2011603075ab04ffb5f327
SHA256

8d6ac358e650e5ef96fe746d082920caca02b42e8fbc1d9f89676b666cb31208
SHA512

c8b55428d0a917551177e918f5ba1e09562f18a1deba9976688a57f58aeb6cd6c27df437c0a6af0efbe142b705fa88812ff2a684ae89c15ae9b7098c5697662e
SSDEEP

768:OkUqYDNyIoKpDd1KM02kQhx4hOtFceWzYqvz:zLioLKtd1PBkQD4UtFceWnz

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	2408	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 912	2408	856-0-0x0000000000400000-0x0000000000409000-memory.exe	17
PID 2408 wrote to memory of 912	2408	856-0-0x0000000000400000-0x0000000000409000-memory.exe	17
PID 2408 wrote to memory of 912	2408	856-0-0x0000000000400000-0x0000000000409000-memory.exe	17
PID 2408 wrote to memory of 912	2408	856-0-0x0000000000400000-0x0000000000409000-memory.exe	17

C:\Users\Admin\AppData\Local\Temp\856-0-0x0000000000400000-0x0000000000409000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\856-0-0x0000000000400000-0x0000000000409000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 36
  2⤵
  - Program crash
  PID:912

memory/2408-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download