smokeloader | 09d6787864b8009da5ebc936eba84fa5c4f2c60e00ef6901636b1b593504507b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 20:47

Target

2404-4-0x0000000000400000-0x000000000040B000-memory.exe
Size

44KB
MD5

75cc3ba787e445a9334190e824afc179
SHA1

dcd6d350c08b58a1092cc3331627c5965ff4fecd
SHA256

09d6787864b8009da5ebc936eba84fa5c4f2c60e00ef6901636b1b593504507b
SHA512

3c5858dd09e3442317519df0b9cd924efc18c1027243601b7b84fff5ea209ff2e627e9db569e5ff23c625e074307bb4f702f827967b0961f6acbcc29d0fcc6c0
SSDEEP

768:TZh9ZkDmuHLgxqkN3Op2OBhGmiHV14sxyv/6thrJ:Txisx7N3M2OvG91+sxyH+B

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1968 1200 WerFault.exe 2404-4-0x0000000000400000-0x000000000040B000-memory.exe

pid	pid_target	process	target process
1968	1200	WerFault.exe	2404-4-0x0000000000400000-0x000000000040B000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2404-4-0x0000000000400000-0x000000000040B000-memory.exe

description	pid	process	target process
PID 1200 wrote to memory of 1968	1200	2404-4-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 1200 wrote to memory of 1968	1200	2404-4-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 1200 wrote to memory of 1968	1200	2404-4-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 1200 wrote to memory of 1968	1200	2404-4-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2404-4-0x0000000000400000-0x000000000040B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2404-4-0x0000000000400000-0x000000000040B000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 36
2⤵
- Program crash
PID:1968

memory/1200-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download