Behavioral task
behavioral1
Sample
2624-745-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2624-745-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2624-745-0x0000000000400000-0x000000000040B000-memory.dmp
-
Size
44KB
-
MD5
48d198ee71aa65caf59b2ca865c62b3a
-
SHA1
efeecb4fba09c44304aa48898d4b6585b51c646c
-
SHA256
b70da093089d128c92bbdd9bcc6dbbc61ef8e105c05b653c7ad683adaa0f5dd1
-
SHA512
c9281b27f7183dc6232e31796eef1f39120197a3adf97de922229b5158c4000ac89b6d6277a3fd668204ea8441ba217340827154e9eaf62cc5ff794820e37e94
-
SSDEEP
768:BWxb8sAvoT5ehqRvNZnUVKfpLCNN8jlBa3:BWqsGQ5eERvNh5fBCIlA
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2624-745-0x0000000000400000-0x000000000040B000-memory.dmp
Files
-
2624-745-0x0000000000400000-0x000000000040B000-memory.dmp.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE