smokeloader | c7004854118f57c1a7b42541763eddda6b89ffeaaa87abfeb1e91aa894d78167 | Triage

Analysis

max time kernel
21s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 15:27

Sharing

Report Analysis Logs

General

Target

c5d9d69fa21c4fa7234c1c797de81500N.exe
Size

200KB
MD5

c5d9d69fa21c4fa7234c1c797de81500
SHA1

361b4d24843b462575e728764cb61435d005a134
SHA256

c7004854118f57c1a7b42541763eddda6b89ffeaaa87abfeb1e91aa894d78167
SHA512

df03e165f248a60eeb8aea117ca3eab8938e1b1744416da775835c4c1f90e59fbc0f59e57fae11da0ef16646ad0cde945b6f60ee98a760d44611fdf7421b995f
SSDEEP

1536:ux4pMHKdLCXQszWivEP6YDHgjmM0/4sHTaLVgbbnRkthXSO3mbVkwBByk5RUtQqX:fvLHoXoHgaMSC6/RuCVkOBh5RUqi

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

C:\Users\Admin\AppData\Local\Temp\c5d9d69fa21c4fa7234c1c797de81500N.exe
"C:\Users\Admin\AppData\Local\Temp\c5d9d69fa21c4fa7234c1c797de81500N.exe"
1⤵
PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3028-4-0x00000000001C0000-0x00000000001CB000-memory.dmp

Filesize
44KB

Download
memory/3028-2-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/3028-1-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3028-5-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download