smokeloader | d5bf55f4d8146212289aa7aa95f2d6f612a822b38abb1d191c158bdeada5ac49 | Triage

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 07:04

Sharing

Report Analysis Logs

General

Target

8f2c2a16d68a8972510dfdb2cb7a027a.exe
Size

214KB
MD5

8f2c2a16d68a8972510dfdb2cb7a027a
SHA1

b1940bdcdb976b415dc4f8942d674a0b8c287f81
SHA256

d5bf55f4d8146212289aa7aa95f2d6f612a822b38abb1d191c158bdeada5ac49
SHA512

5d064bb7b2bcd9225ba2c81561f1c687d62245e94edb0f77142430715d94853d2eba027a99f5bde72efa4a4d169485b03e8a9f92fba29faa3e7859de2bf39f5c
SSDEEP

3072:+2GyEV4yut+w3vGCc0XCp/I4WpL8n59yOZ:ub5WjcSCZYEyO

Score

10^/10

smokeloader pub2 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

C:\Users\Admin\AppData\Local\Temp\8f2c2a16d68a8972510dfdb2cb7a027a.exe
"C:\Users\Admin\AppData\Local\Temp\8f2c2a16d68a8972510dfdb2cb7a027a.exe"
1⤵
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1656-1-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1656-4-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1656-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1656-5-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download