Overview

overview

10

Static

static

10

5012-249-0...ry.exe

windows7-x64

10

5012-249-0...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    99s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2023, 12:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5012-249-0x0000000000400000-0x0000000000409000-memory.exe

  • Size

    36KB

  • MD5

    445a88612d3c0a60210501dcc691c00f

  • SHA1

    e701278b57f54ccd4526f24a8d769465e994b8af

  • SHA256

    4c05482dbab83cc2536bad8e6b7adcb5e9232d8134ad4c6f7e71af885b4cd2d3

  • SHA512

    0bea4c257c9c9839e36fc4fbdecbf88d53686524905f34d27c9a040085d21ab472643f70f2f1283d8f3f98f4e957c6c93e4dc9010b2c26f13bb2c77953a84f6b

  • SSDEEP

    768:OkUqYDNaIoKpDd1KM02kQhx4hOtFceWzYqvz0bOS:zLiELKtd1PBkQD4UtFceWnz

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5012-249-0x0000000000400000-0x0000000000409000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\5012-249-0x0000000000400000-0x0000000000409000-memory.exe"
    1⤵
      PID:1204
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 224
        2⤵
        • Program crash
        PID:1864
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1204 -ip 1204
      1⤵
        PID:732

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1204-0-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

        Download