smokeloader | 600d12c5f280a0099768da6eb1d848c38b034a5dd2a9c552cd48468010250406 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-11-2024 13:27

Sharing

Report Analysis Logs

General

Target

600d12c5f280a0099768da6eb1d848c38b034a5dd2a9c552cd48468010250406N.exe
Size

235KB
MD5

f5c1aae46b6a8b195cf1b47e2b8e1130
SHA1

3b076f628c5f7ad7cf46b62e36b3848cfe360739
SHA256

600d12c5f280a0099768da6eb1d848c38b034a5dd2a9c552cd48468010250406
SHA512

dc8842247eed26846c9fd1c85b2780f10e1787ecfc5376ce849aec54f3785fa8bb7e35c34dae3b9cb498d02ea3bbeb7779bf9bdf1f78a8e32313b75e8874d159
SSDEEP

1536:mVeFjCBnCaz6rE1cY9fXwZk9wHpbwv/w8gAHivc5JOSKjZMSv+O3l0idAQ/n7Wt9:HjAJXopwv/rzHivc51HWrMjRSqWttc

Score

10^/10

smokeloader pub1 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\600d12c5f280a0099768da6eb1d848c38b034a5dd2a9c552cd48468010250406N.exe
"C:\Users\Admin\AppData\Local\Temp\600d12c5f280a0099768da6eb1d848c38b034a5dd2a9c552cd48468010250406N.exe"
1⤵
PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-1-0x0000000002C30000-0x0000000002D30000-memory.dmp

Filesize
1024KB

Download
memory/2100-2-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2100-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2100-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2100-5-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2100-4-0x0000000000400000-0x0000000002B3E000-memory.dmp

Filesize
39.2MB

Download