smokeloader | 8e42060c026f698ff96dfca19c40ee455e4d8f4ca11650f720aa0a78f07ae2f1

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 23:57

Target

2432-3-0x0000000000400000-0x000000000040B000-memory.exe
Size

44KB
MD5

f810136bcdd606d09efced58b13c497b
SHA1

e3ea9f18af29d5536c1a2e6e68d6ee97f34509af
SHA256

8e42060c026f698ff96dfca19c40ee455e4d8f4ca11650f720aa0a78f07ae2f1
SHA512

7429613fe2452e734d4de7d03c45d0f31ef957565424ebf9e55cc4809f63e30bec31b6b2482ebe41db9654df7868ff370d845d57bee76e309340e8a72ba3fb8b
SSDEEP

768:Z/8mWE+vc466DhR8ZSDc28hO3c3VgDeoVZnE:2a+0466DhR8658533s

Score

10^/10

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1604 2232 WerFault.exe 2432-3-0x0000000000400000-0x000000000040B000-memory.exe

pid	pid_target	process	target process
1604	2232	WerFault.exe	2432-3-0x0000000000400000-0x000000000040B000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2432-3-0x0000000000400000-0x000000000040B000-memory.exe

description	pid	process	target process
PID 2232 wrote to memory of 1604	2232	2432-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 2232 wrote to memory of 1604	2232	2432-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 2232 wrote to memory of 1604	2232	2432-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe
PID 2232 wrote to memory of 1604	2232	2432-3-0x0000000000400000-0x000000000040B000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2432-3-0x0000000000400000-0x000000000040B000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2432-3-0x0000000000400000-0x000000000040B000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 36
2⤵
- Program crash
PID:1604

memory/2232-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download