smokeloader | 58589a37ad805b35a51cc6910e05fddd69eaebaa52bd09de6fb60b71e0ac3565 | Triage

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 19:36

Sharing

Report Analysis Logs

General

Target

58589a37ad805b35a51cc6910e05fddd69eaebaa52bd09de6fb60b71e0ac3565.exe
Size

233KB
MD5

37af2c2b7a25f9cfe8f82d44d3c06c5a
SHA1

0e9333a59f54e5aa40f5595df25493c73388729a
SHA256

58589a37ad805b35a51cc6910e05fddd69eaebaa52bd09de6fb60b71e0ac3565
SHA512

f290b2775b3f48391912ea8b267c2a0efdcb79335ad2fbce9601af0ec1bb3fbd6678f33c44b4a9a36a342c53955ef22c6eef90d1a8e89279daf87b262fc9cb64
SSDEEP

3072:JGhKikQxIHv9OlnJe6rJsx6+32YSZG6P5VisE/xdqwXIe+CNf4/AWaSkSJu98vdb:VQxIHv9Ox0M5z5VisiYUIADG8elb

Score

10^/10

smokeloader pub5 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub5

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

C:\Users\Admin\AppData\Local\Temp\58589a37ad805b35a51cc6910e05fddd69eaebaa52bd09de6fb60b71e0ac3565.exe
"C:\Users\Admin\AppData\Local\Temp\58589a37ad805b35a51cc6910e05fddd69eaebaa52bd09de6fb60b71e0ac3565.exe"
1⤵
PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2388-0-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2388-1-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/2388-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2388-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2388-5-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/2388-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2388-3-0x0000000000400000-0x0000000002F01000-memory.dmp

Filesize
43.0MB

Download