smokeloader | 5d2321e602583ecca107e9bd3f85974cad4d61565348be4ee3b14bfd6bc2c61d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231130-en
resource tags

arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
submitted
12-12-2023 02:57

Target

1876-0-0x0000000000400000-0x0000000000409000-memory.exe
Size

36KB
MD5

b7e7ff5e6522fb3a844b8f7ec65fc50d
SHA1

929f7902d2db02e285055acb2dbd9bdbd2f29e3a
SHA256

5d2321e602583ecca107e9bd3f85974cad4d61565348be4ee3b14bfd6bc2c61d
SHA512

0a9333c743cd262772fcd4912134a3c5db02e4b714dd48e4e0f3b1929bdd94fd6e32364764be012bd38d970183d037ecd9eca680f5aab13552570b6a57373ea6
SSDEEP

768:OAUoYtNnIoKpDd1KM02kQhx4hOtFceWzYqvz0bOS:H5E1LKtd1PBkQD4UtFceWnz

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2068	1428	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2068	1428	1876-0-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 1428 wrote to memory of 2068	1428	1876-0-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 1428 wrote to memory of 2068	1428	1876-0-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 1428 wrote to memory of 2068	1428	1876-0-0x0000000000400000-0x0000000000409000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\1876-0-0x0000000000400000-0x0000000000409000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1876-0-0x0000000000400000-0x0000000000409000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 36
  2⤵
  - Program crash
  PID:2068

memory/1428-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download