smokeloader | 55a7d49fa8f8affed39d47f9ba1ad6f0f3bf8f7b2530563499abefe47b68c93a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 23:15

Target

220-3-0x0000000000400000-0x000000000040B000-memory.exe
Size

44KB
MD5

69ed653605008678bf3b9a68c7f10423
SHA1

63de22d00bb82477fdb78f03066e73b6dbd49b1a
SHA256

55a7d49fa8f8affed39d47f9ba1ad6f0f3bf8f7b2530563499abefe47b68c93a
SHA512

cf98742e503d77b100145b6e377485dfb0ad9cd1af6f297365c79d5970281a980a18d64fe88bbd12b52faf5f08db1562649934d6ddf756e60e00762e5a728009
SSDEEP

768:Z/8mWE+vc4/6DhR8ZSDc28hO3c3VgDeoVZnE:2a+04/6DhR8658533s

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2032 3000 WerFault.exe 220-3-0x0000000000400000-0x000000000040B000-memory.exe

pid	pid_target	process	target process
2032	3000	WerFault.exe	220-3-0x0000000000400000-0x000000000040B000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

220-3-0x0000000000400000-0x000000000040B000-memory.exe

description	pid	process	target process
PID 3000 wrote to memory of 2032	3000	220-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 3000 wrote to memory of 2032	3000	220-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 3000 wrote to memory of 2032	3000	220-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 3000 wrote to memory of 2032	3000	220-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\220-3-0x0000000000400000-0x000000000040B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\220-3-0x0000000000400000-0x000000000040B000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 36
2⤵
- Program crash
PID:2032

memory/3000-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download