smokeloader | 92f03cb717d62d79296e0b3b0802bcb73fabb9c02f412e8a6b0d7bf69dcaf118

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 01:15

Target

debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe
Size

1.1MB
MD5

43c498cf3e4f835f38cec7a475bc5e2c
SHA1

a810481973afefc920845d7f937b51201a09c58b
SHA256

debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60
SHA512

cc7300050dfa3613aba9e74ed6373018a1011d3f8bf5ee65e9152b13ac2e9b7f577c56490b8c58f5506dcf11e025ae3695a639e3abeec3829033f21925e644f2
SSDEEP

12288:EqMVbxllIU0til6szxaeaQlqPFXA4yKRahvbAi+a7B0nC7elWSohmL/fRzrM2u8U:EFlpmNQlULyKRahvbAiv9JzmLhzrnq7

Score

10^/10

Family

smokeloader

Botnet

pub3

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe

description	pid	process	target process
PID 2228 set thread context of 2560	2228	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe

description	pid	process	target process
PID 2228 wrote to memory of 2560	2228	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe
PID 2228 wrote to memory of 2560	2228	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe
PID 2228 wrote to memory of 2560	2228	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe
PID 2228 wrote to memory of 2560	2228	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe
PID 2228 wrote to memory of 2560	2228	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe
PID 2228 wrote to memory of 2560	2228	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe
PID 2228 wrote to memory of 2560	2228	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe	debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe

C:\Users\Admin\AppData\Local\Temp\debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe
"C:\Users\Admin\AppData\Local\Temp\debeea64857d020a5626850ad7f0b850b08dda331336e5e79004ec1d0fcc3a60.exe"
2⤵
PID:2560

memory/2560-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2560-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2560-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2560-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2560-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2560-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download