smokeloader | d5bf55f4d8146212289aa7aa95f2d6f612a822b38abb1d191c158bdeada5ac49 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 02:01 UTC

Sharing

Report Analysis Logs

General

Target

d5bf55f4d8146212289aa7aa95f2d6f612a822b38abb1d191c158bdeada5ac49.exe
Size

214KB
MD5

8f2c2a16d68a8972510dfdb2cb7a027a
SHA1

b1940bdcdb976b415dc4f8942d674a0b8c287f81
SHA256

d5bf55f4d8146212289aa7aa95f2d6f612a822b38abb1d191c158bdeada5ac49
SHA512

5d064bb7b2bcd9225ba2c81561f1c687d62245e94edb0f77142430715d94853d2eba027a99f5bde72efa4a4d169485b03e8a9f92fba29faa3e7859de2bf39f5c
SSDEEP

3072:+2GyEV4yut+w3vGCc0XCp/I4WpL8n59yOZ:ub5WjcSCZYEyO

Score

10^/10

smokeloader pub2 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

C:\Users\Admin\AppData\Local\Temp\d5bf55f4d8146212289aa7aa95f2d6f612a822b38abb1d191c158bdeada5ac49.exe
"C:\Users\Admin\AppData\Local\Temp\d5bf55f4d8146212289aa7aa95f2d6f612a822b38abb1d191c158bdeada5ac49.exe"
1⤵
PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-2-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2172-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2172-3-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2172-1-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2172-5-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download