smokeloader | 309a42c59f64fb06fdfeea90090c323399267198946433a785f92ec37701c34b

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 17:51

Target

424-3-0x0000000000400000-0x000000000040B000-memory.exe
Size

44KB
MD5

be4c8fc089f996b828b1a98f5fa45f65
SHA1

7acc8d9263d5f556b366f6efd2b4f6dd62f96924
SHA256

309a42c59f64fb06fdfeea90090c323399267198946433a785f92ec37701c34b
SHA512

4e947a520d18dddc50eb18e1e98e4d31116b91cd87faa9d47eadb04c2dd4f01082f02aee894d514a4b7d9b957d08cdbbede9ea8b075e32c7a899023e014fd9fb
SSDEEP

768:Z/8mWE+vIYpU6DhR8ZSDc28hO3c3VgDeoVZnE:2a+QYC6DhR8658533s

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3828 4484 WerFault.exe 424-3-0x0000000000400000-0x000000000040B000-memory.exe

pid	pid_target	process	target process
3828	4484	WerFault.exe	424-3-0x0000000000400000-0x000000000040B000-memory.exe

C:\Users\Admin\AppData\Local\Temp\424-3-0x0000000000400000-0x000000000040B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\424-3-0x0000000000400000-0x000000000040B000-memory.exe"
1⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 224
2⤵
- Program crash
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4484 -ip 4484
1⤵
PID:2480

memory/4484-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download