smokeloader | 45fc7f8dd674b1df2e142dbd7cd6629aca0bf9d179b869e933b0f946e29648bc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 04:50

Target

1664-3-0x0000000000400000-0x000000000040B000-memory.exe
Size

44KB
MD5

2565a5faa08119f664ebe63198a82f36
SHA1

50ed0de0d7de16de8b13b89e854682932b98b48a
SHA256

45fc7f8dd674b1df2e142dbd7cd6629aca0bf9d179b869e933b0f946e29648bc
SHA512

012c6db8d597f853dabc0355522b6a3f4b95a3d4c2ef3cdef09237ae27541688f9c88b1ee1ae4a6b8973aa1c20827595b63cb62f41bcbbeb14ddbbf7e642cdc9
SSDEEP

768:o1rG++0ruYuRysRK+2Ohm7rDtHqnZzl1xP5SusjSLun9hQ++Kd:o5G++04z4vxkzHxP5Nsj8khQ+v

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2744 2016 WerFault.exe 1664-3-0x0000000000400000-0x000000000040B000-memory.exe

pid	pid_target	process	target process
2744	2016	WerFault.exe	1664-3-0x0000000000400000-0x000000000040B000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1664-3-0x0000000000400000-0x000000000040B000-memory.exe

description	pid	process	target process
PID 2016 wrote to memory of 2744	2016	1664-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 2016 wrote to memory of 2744	2016	1664-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 2016 wrote to memory of 2744	2016	1664-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 2016 wrote to memory of 2744	2016	1664-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1664-3-0x0000000000400000-0x000000000040B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1664-3-0x0000000000400000-0x000000000040B000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 36
2⤵
- Program crash
PID:2744

memory/2016-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download