smokeloader | dd4ff1b8b990b4cee33d9f2504e1167c27d352a1be0b8a9e80469176e34a6010

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 08:43

Target

804-6-0x0000000000400000-0x0000000000409000-memory.exe
Size

36KB
MD5

dfa5eb9f31696dba0c4bd0e124ccbfae
SHA1

780a49a4b56ecb7407e01032c0ca0155ac63255f
SHA256

dd4ff1b8b990b4cee33d9f2504e1167c27d352a1be0b8a9e80469176e34a6010
SHA512

4fc42f7d35f455efbfe01f165a838080705a5a2412edfd0aade27fcf7748be117865a1e530f830b7e2c224f50f66d82ba1e062afbe2fb757575f6d598b1ab562
SSDEEP

768:OkUqYDNTIoKpDd1KM02kQhx4hOtFceWzYqvz0bOS:zLiRLKtd1PBkQD4UtFceWnz

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 1240 WerFault.exe 804-6-0x0000000000400000-0x0000000000409000-memory.exe

pid	pid_target	process	target process
2028	1240	WerFault.exe	804-6-0x0000000000400000-0x0000000000409000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

804-6-0x0000000000400000-0x0000000000409000-memory.exe

description	pid	process	target process
PID 1240 wrote to memory of 2028	1240	804-6-0x0000000000400000-0x0000000000409000-memory.exe	WerFault.exe
PID 1240 wrote to memory of 2028	1240	804-6-0x0000000000400000-0x0000000000409000-memory.exe	WerFault.exe
PID 1240 wrote to memory of 2028	1240	804-6-0x0000000000400000-0x0000000000409000-memory.exe	WerFault.exe
PID 1240 wrote to memory of 2028	1240	804-6-0x0000000000400000-0x0000000000409000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\804-6-0x0000000000400000-0x0000000000409000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\804-6-0x0000000000400000-0x0000000000409000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 36
2⤵
- Program crash
PID:2028

memory/1240-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download