smokeloader | 5b292de4fc907bf09e8409ba9aea78c65bee85cb1b34e9516a9de35323f7306f

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 20:40

Target

5b292de4fc907bf09e8409ba9aea78c65bee85cb1b34e9516a9de35323f7306f.exe
Size

233KB
MD5

a6d789f7f381a9d824e67ed2b2104d66
SHA1

04db9745d3862bf84c03efcd30190ffeb3343f14
SHA256

5b292de4fc907bf09e8409ba9aea78c65bee85cb1b34e9516a9de35323f7306f
SHA512

5ff2bf11610b2f646406020dad334291fdb6b1d1a1e043aceee1b163d4c96611e5bc29f7667577f20a59f177c5c31fab2a529efc171dbfdf084a12a394cc695e
SSDEEP

3072:FGhKSUgxInv9/zRt2aKcyQD6P5yiRMZINT44+CNf4/AWaSkSJu98vdz:hgxInv972aKcyd5yiRIINT4CIADG8elz

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader
Loads dropped DLL 1 IoCs

Processes:

5b292de4fc907bf09e8409ba9aea78c65bee85cb1b34e9516a9de35323f7306f.exe

pid process

2808 5b292de4fc907bf09e8409ba9aea78c65bee85cb1b34e9516a9de35323f7306f.exe

pid	process
2808	5b292de4fc907bf09e8409ba9aea78c65bee85cb1b34e9516a9de35323f7306f.exe

C:\Users\Admin\AppData\Local\Temp\5b292de4fc907bf09e8409ba9aea78c65bee85cb1b34e9516a9de35323f7306f.exe
"C:\Users\Admin\AppData\Local\Temp\5b292de4fc907bf09e8409ba9aea78c65bee85cb1b34e9516a9de35323f7306f.exe"
1⤵
- Loads dropped DLL
PID:2808

\Users\Admin\AppData\Local\Temp\1105.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
memory/2808-1-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/2808-0-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2808-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2808-7-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2808-8-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/2808-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2808-6-0x0000000000400000-0x0000000002F01000-memory.dmp

Filesize
43.0MB

Download