smokeloader | a3a1876bbfd89eb37eba20ff2285251ca4874b3c84149eb412d3eeb973a97306

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 20:50

Target

1620-6-0x0000000000400000-0x0000000000409000-memory.exe
Size

36KB
MD5

de4752982aeb8ec93ecba64d70c0659a
SHA1

7f8b9a9eed35bac0dd5b48611bae264123ad71d3
SHA256

a3a1876bbfd89eb37eba20ff2285251ca4874b3c84149eb412d3eeb973a97306
SHA512

3c069dd3d3e06c11e8fd1cf2807c3f0b1ab447c2538e2d10ccabb6a1c69d4b7ed32f2dd83e0c407d2255bc22a775e366c80ec2a3b5db805b66c73392d862e25d
SSDEEP

768:OkUqYDNPIoKpDd1KM02kQhx4hOtFceWzYqvz0bOS:zLiBLKtd1PBkQD4UtFceWnz

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	2956	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2964	2956	1620-6-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 2956 wrote to memory of 2964	2956	1620-6-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 2956 wrote to memory of 2964	2956	1620-6-0x0000000000400000-0x0000000000409000-memory.exe	28
PID 2956 wrote to memory of 2964	2956	1620-6-0x0000000000400000-0x0000000000409000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\1620-6-0x0000000000400000-0x0000000000409000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1620-6-0x0000000000400000-0x0000000000409000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 36
  2⤵
  - Program crash
  PID:2964

memory/2956-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download