smokeloader | 78ffb8426b47cac183d50f6ae9ac80525d4f316ccf46bcd9d181d1459138a471

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
Size 213KB
Sample240529-b4sjdsdc8v
SHA256 003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6
MD5 c143fa19a5123ae26eb5871035bf3f29
SHA1 b972a83d721f1b596234e198880b7a726af6b768
SHA512 ec756a7e5cc130d774170fdbc0af86a3c66530f24725d470b560fcb127c8b91786bbac85b17175dd6ef0dbdaf52160fda936e40f19772139e9bbf4353d2717f0
SSDEEP 6144:sjd0dJL6inu2Z2GTo7nUHP0Q39vvg3ClIAU0V6:ud0zOeu2No70P0mv4Sl2O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader lab backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1832 set thread context of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	28

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	28
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	28
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	28
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	28
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	28
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	28
PID 1832 wrote to memory of 1916	1832	003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe	28

C:\Users\Admin\AppData\Local\Temp\003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
"C:\Users\Admin\AppData\Local\Temp\003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
  "C:\Users\Admin\AppData\Local\Temp\003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe"
  2⤵
  PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-5-0x0000000000220000-0x0000000000229000-memory.dmp

Download

memory/1832-4-0x0000000000620000-0x0000000000630000-memory.dmp

Download

memory/1916-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1916-6-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1916-7-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1916-8-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads