smokeloader | d9546acf6e68ce1ed866c2f06bb34ee33441efd7a315e061f0b6d37f200af23b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 12:49

Target

964-3-0x0000000000400000-0x000000000040B000-memory.exe
Size

44KB
MD5

cf8fad35bab1927396014d7ba84044aa
SHA1

c0649520a92d672a11cc2676c9cfb8f1daf34c59
SHA256

d9546acf6e68ce1ed866c2f06bb34ee33441efd7a315e061f0b6d37f200af23b
SHA512

50372a098955ac6f888141c50892ba4421a2aeb6b370b2d548e1e23f7ae22d2d4c701c270ad07b9fc13d406b97965db23ec1bfe948a085869ad6a6d57f2bd798
SSDEEP

768:O2fNN6rUCUsNJrlhRtSEObrfWrZrZZGazbv61kTtnIx1y0qWb:OQNsrIUFP7sbrOZXGaXi1kyG0P

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2876 1856 WerFault.exe 964-3-0x0000000000400000-0x000000000040B000-memory.exe

pid	pid_target	process	target process
2876	1856	WerFault.exe	964-3-0x0000000000400000-0x000000000040B000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

964-3-0x0000000000400000-0x000000000040B000-memory.exe

description	pid	process	target process
PID 1856 wrote to memory of 2876	1856	964-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 1856 wrote to memory of 2876	1856	964-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 1856 wrote to memory of 2876	1856	964-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 1856 wrote to memory of 2876	1856	964-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\964-3-0x0000000000400000-0x000000000040B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\964-3-0x0000000000400000-0x000000000040B000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 36
2⤵
- Program crash
PID:2876

memory/1856-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download