smokeloader | 12efe37d7a4c11c33a7def05f05691eb01923434a8cda8886bbd8de8b58e1ca3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 07:24

Target

3104-3-0x0000000000400000-0x000000000040B000-memory.exe
Size

44KB
MD5

25ef05eca2b618203ba06b066e47bdc9
SHA1

dcc5d80838235f35d28d2e28b5d2272e29f6c338
SHA256

12efe37d7a4c11c33a7def05f05691eb01923434a8cda8886bbd8de8b58e1ca3
SHA512

69211fe3eba6cc991cd71b80da39ee06d372848ea27446b2b74d581d99da63486796ca4be2d77aabeb71ec81a000a0c28b502c4eff0ea310711ea3f8da451e89
SSDEEP

768:Z/8mWE+vc4G6DhR8ZSDc28hO3c3VgDeoVZnE:2a+04G6DhR8658533s

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2320 3028 WerFault.exe 3104-3-0x0000000000400000-0x000000000040B000-memory.exe

pid	pid_target	process	target process
2320	3028	WerFault.exe	3104-3-0x0000000000400000-0x000000000040B000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3104-3-0x0000000000400000-0x000000000040B000-memory.exe

description	pid	process	target process
PID 3028 wrote to memory of 2320	3028	3104-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 3028 wrote to memory of 2320	3028	3104-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 3028 wrote to memory of 2320	3028	3104-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 3028 wrote to memory of 2320	3028	3104-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3104-3-0x0000000000400000-0x000000000040B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3104-3-0x0000000000400000-0x000000000040B000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 36
2⤵
- Program crash
PID:2320

memory/3028-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download