smokeloader | 2fb4d4500d27504e8b9ea2c8a29060079e1c6674d89914708ffeb1e47d168351

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 22:31

Target
2368-0-0x0000000000400000-0x000000000040B000-memory.exe
Size 44KB
Sample240526-2fvlysfd69
SHA256 2fb4d4500d27504e8b9ea2c8a29060079e1c6674d89914708ffeb1e47d168351
MD5 0f09cc02af604539a5ee308e4553ae94
SHA1 cf2c6b0540dd42fd20b309b0f621992a636d89bd
SHA512 e476bcb473ac568fd8157e726e0f9804df4f3a56a057d79c538fbb5b752c3c324a47bb748ee88e9fb26e918ad26b4deecf6366306a7e1d6e7bae0880838b8aa2
SSDEEP 768:yBQB1CTmqUQHXQkkU3NIZjKQu/MGQ2lsDBw7en:yBc0+yQmNIZreMp28O7Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4856	4076	WerFault.exe	90

C:\Users\Admin\AppData\Local\Temp\2368-0-0x0000000000400000-0x000000000040B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2368-0-0x0000000000400000-0x000000000040B000-memory.exe"
1⤵
PID:4076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 224
  2⤵
  - Program crash
  PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4076 -ip 4076
1⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3948 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3872

memory/4076-0-0x0000000000400000-0x000000000040B000-memory.dmp

Download