smokeloader | b7ba148ee92911133697415435ef33d98829b0311a641e479b37e8a0468bad6c | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
31-03-2024 12:29

Sharing

Report Analysis Logs

General

Target

7b60671c.exe
Size

313KB
MD5

849a173f9eeb87cb0675298e884e3e19
SHA1

059d4c20611f181f6d201898a21b74bbf2cd33f0
SHA256

b7ba148ee92911133697415435ef33d98829b0311a641e479b37e8a0468bad6c
SHA512

ac60c500a7a75697db92ee6f9dc62c278ebc76e53608b424d0aa7b4eff79a4cd19f8dfa867654c79bd8f1c290704926be055bd3713a1e70ac213c3afc6140809
SSDEEP

3072:VLEfWCd21xkD+ywZXh2DZotrdHvyLJW/G5pwqgJdkNNlDH3oBlMT6a:VI3MzkDQLtZ8+G5pTgP80BCT

Score

10^/10

smokeloader pub3 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2296 2188 WerFault.exe 7b60671c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7b60671c.exe

description	pid	process	target process
PID 2188 wrote to memory of 2296	2188	7b60671c.exe	WerFault.exe
PID 2188 wrote to memory of 2296	2188	7b60671c.exe	WerFault.exe
PID 2188 wrote to memory of 2296	2188	7b60671c.exe	WerFault.exe
PID 2188 wrote to memory of 2296	2188	7b60671c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7b60671c.exe
"C:\Users\Admin\AppData\Local\Temp\7b60671c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 136
  2⤵
  - Program crash
  PID:2296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-1-0x0000000002DF0000-0x0000000002EF0000-memory.dmp

Filesize
1024KB

Download
memory/2188-2-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2188-3-0x0000000000400000-0x0000000002D4D000-memory.dmp

Filesize
41.3MB

Download
memory/2188-5-0x0000000002DF0000-0x0000000002EF0000-memory.dmp

Filesize
1024KB

Download