smokeloader | d99adf608f6a7296524dd024cdb10e9e181521b10b85c42192aca59b88bbcbba

Analysis

max time kernel
94s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 17:06

Target
4700-3-0x0000000000400000-0x000000000040B000-memory.exe
Size 44KB
Sample240709-vmt6favbjj
SHA256 d99adf608f6a7296524dd024cdb10e9e181521b10b85c42192aca59b88bbcbba
MD5 ef211bd56f75cabd7e60fae650a1749c
SHA1 9b2282c3f6ed7e9960999a13d99d084e4c0db20c
SHA512 7d8d60f621069ffd8d57c8da28027b1ca2fa40c7e0fd814f3b54af7c8ca529d63b31c3ee3af924a7bae7a6da702b54e606ac45381d1d6e79406e26c9fe275738
SSDEEP 768:Z/8mWE+vIYXU6DhR8ZSDc28hO3c3VgDeoVZnE:2a+QYk6DhR8658533s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4512	1892	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\4700-3-0x0000000000400000-0x000000000040B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4700-3-0x0000000000400000-0x000000000040B000-memory.exe"
1⤵
PID:1892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 228
  2⤵
  - Program crash
  PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1892 -ip 1892
1⤵
PID:1536

memory/1892-0-0x0000000000400000-0x000000000040B000-memory.dmp

Download