smokeloader | 78ffb8426b47cac183d50f6ae9ac80525d4f316ccf46bcd9d181d1459138a471

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 01:42

Target

003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
Size

213KB
MD5

c143fa19a5123ae26eb5871035bf3f29
SHA1

b972a83d721f1b596234e198880b7a726af6b768
SHA256

003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6
SHA512

ec756a7e5cc130d774170fdbc0af86a3c66530f24725d470b560fcb127c8b91786bbac85b17175dd6ef0dbdaf52160fda936e40f19772139e9bbf4353d2717f0
SSDEEP

6144:sjd0dJL6inu2Z2GTo7nUHP0Q39vvg3ClIAU0V6:ud0zOeu2No70P0mv4Sl2O

Score

10^/10

Family

smokeloader

Botnet

lab

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe

description	pid	process	target process
PID 1832 set thread context of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe

description	pid	process	target process
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe

C:\Users\Admin\AppData\Local\Temp\003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
"C:\Users\Admin\AppData\Local\Temp\003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe"
2⤵
PID:1916

memory/1832-5-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/1832-4-0x0000000000620000-0x0000000000630000-memory.dmp

Filesize
64KB

Download
memory/1916-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1916-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1916-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1916-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download