smokeloader | 71480fc81a1e0eb85d94e08b31fa257204200371c01fbc3cbf7c45a622e66da3

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 01:19

Target

71480fc81a1e0eb85d94e08b31fa257204200371c01fbc3cbf7c45a622e66da3.exe
Size

219KB
MD5

503e59094f106fd25a0a6193d7556cdc
SHA1

f255f91c7d8fc94e4ec265b9ae5d2752c66b8fa2
SHA256

71480fc81a1e0eb85d94e08b31fa257204200371c01fbc3cbf7c45a622e66da3
SHA512

99d73876925ad80afbdecb675b911a4043e146fa4a5370444467cf3532d228d702131c4e0d57be897e08adb42b20a4e8d3069274a14a4c2ae1035e0ef54c80fa
SSDEEP

3072:Wu5cM9Mh1cHctcQI041+TBhLyRd5rZmSUZ1ivIRFC2sx++cQN/pLpay:CM9bscR00+85rZfUDivIzy+BCh

Score

10^/10

Family

smokeloader

Botnet

pub1

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1308 1264 WerFault.exe 71480fc81a1e0eb85d94e08b31fa257204200371c01fbc3cbf7c45a622e66da3.exe

pid	pid_target	process	target process
1308	1264	WerFault.exe	71480fc81a1e0eb85d94e08b31fa257204200371c01fbc3cbf7c45a622e66da3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

71480fc81a1e0eb85d94e08b31fa257204200371c01fbc3cbf7c45a622e66da3.exe

description	pid	process	target process
PID 1264 wrote to memory of 1308	1264	71480fc81a1e0eb85d94e08b31fa257204200371c01fbc3cbf7c45a622e66da3.exe	WerFault.exe
PID 1264 wrote to memory of 1308	1264	71480fc81a1e0eb85d94e08b31fa257204200371c01fbc3cbf7c45a622e66da3.exe	WerFault.exe
PID 1264 wrote to memory of 1308	1264	71480fc81a1e0eb85d94e08b31fa257204200371c01fbc3cbf7c45a622e66da3.exe	WerFault.exe
PID 1264 wrote to memory of 1308	1264	71480fc81a1e0eb85d94e08b31fa257204200371c01fbc3cbf7c45a622e66da3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\71480fc81a1e0eb85d94e08b31fa257204200371c01fbc3cbf7c45a622e66da3.exe
"C:\Users\Admin\AppData\Local\Temp\71480fc81a1e0eb85d94e08b31fa257204200371c01fbc3cbf7c45a622e66da3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 136
  2⤵
  - Program crash
  PID:1308

memory/1264-1-0x0000000002DB0000-0x0000000002EB0000-memory.dmp

Filesize
1024KB

Download
memory/1264-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1264-2-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/1264-4-0x0000000000400000-0x0000000002C96000-memory.dmp

Filesize
40.6MB

Download
memory/1264-6-0x0000000002DB0000-0x0000000002EB0000-memory.dmp

Filesize
1024KB

Download