Overview
overview
10Static
static
10setup_inst...32.exe
windows7_x64
10setup_inst...32.exe
windows10_x64
10setup_inst...2b.exe
windows7_x64
8setup_inst...2b.exe
windows10_x64
8setup_inst...61.exe
windows7_x64
10setup_inst...61.exe
windows10_x64
10setup_inst...f8.exe
windows7_x64
10setup_inst...f8.exe
windows10_x64
10setup_inst...34.exe
windows7_x64
10setup_inst...34.exe
windows10_x64
10setup_inst...c2.exe
windows7_x64
3setup_inst...c2.exe
windows10_x64
10setup_inst...cb.exe
windows7_x64
10setup_inst...cb.exe
windows10_x64
10setup_inst...90.exe
windows7_x64
10setup_inst...90.exe
windows10_x64
10setup_inst...79.exe
windows7_x64
6setup_inst...79.exe
windows10_x64
6setup_inst...d8.exe
windows7_x64
7setup_inst...d8.exe
windows10_x64
3setup_inst...3b.exe
windows7_x64
8setup_inst...3b.exe
windows10_x64
8setup_inst...ac.exe
windows7_x64
10setup_inst...ac.exe
windows10_x64
10setup_inst...38.exe
windows7_x64
10setup_inst...38.exe
windows10_x64
10setup_inst...b5.exe
windows7_x64
10setup_inst...b5.exe
windows10_x64
10setup_inst...b2.exe
windows7_x64
7setup_inst...b2.exe
windows10_x64
7setup_inst...rl.dll
windows7_x64
3setup_inst...rl.dll
windows10_x64
3Analysis
-
max time kernel
157s -
max time network
151s -
submitted
01-01-1970 00:00
Behavioral task
behavioral1
Sample
setup_installer/Wed0901eb1dae126e32.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
setup_installer/Wed0901eb1dae126e32.exe
Resource
win10-en-20210920
Behavioral task
behavioral3
Sample
setup_installer/Wed094c47c32b.exe
Resource
win7-en-20211014
Behavioral task
behavioral4
Sample
setup_installer/Wed094c47c32b.exe
Resource
win10-en-20210920
Behavioral task
behavioral5
Sample
setup_installer/Wed096a1bff61.exe
Resource
win7-en-20211014
Behavioral task
behavioral6
Sample
setup_installer/Wed096a1bff61.exe
Resource
win10-en-20210920
Behavioral task
behavioral7
Sample
setup_installer/Wed0971f17486f8.exe
Resource
win7-en-20210920
Behavioral task
behavioral8
Sample
setup_installer/Wed0971f17486f8.exe
Resource
win10-en-20211014
Behavioral task
behavioral9
Sample
setup_installer/Wed09977fdc12334.exe
Resource
win7-en-20210920
Behavioral task
behavioral10
Sample
setup_installer/Wed09977fdc12334.exe
Resource
win10-en-20211014
Behavioral task
behavioral11
Sample
setup_installer/Wed09abf83d9c2.exe
Resource
win7-en-20210920
Behavioral task
behavioral12
Sample
setup_installer/Wed09abf83d9c2.exe
Resource
win10-en-20210920
Behavioral task
behavioral13
Sample
setup_installer/Wed09b2a8bc4f16cb.exe
Resource
win7-en-20211014
Behavioral task
behavioral14
Sample
setup_installer/Wed09b2a8bc4f16cb.exe
Resource
win10-en-20210920
Behavioral task
behavioral15
Sample
setup_installer/Wed09b3a5ca1a712d390.exe
Resource
win7-en-20211014
Behavioral task
behavioral16
Sample
setup_installer/Wed09b3a5ca1a712d390.exe
Resource
win10-en-20210920
Behavioral task
behavioral17
Sample
setup_installer/Wed09c42cad92c20f79.exe
Resource
win7-en-20211014
Behavioral task
behavioral18
Sample
setup_installer/Wed09c42cad92c20f79.exe
Resource
win10-en-20210920
Behavioral task
behavioral19
Sample
setup_installer/Wed09cfb2f9758281d8.exe
Resource
win7-en-20211014
Behavioral task
behavioral20
Sample
setup_installer/Wed09cfb2f9758281d8.exe
Resource
win10-en-20210920
Behavioral task
behavioral21
Sample
setup_installer/Wed09d27135e5a8b3b.exe
Resource
win7-en-20210920
Behavioral task
behavioral22
Sample
setup_installer/Wed09d27135e5a8b3b.exe
Resource
win10-en-20211014
Behavioral task
behavioral23
Sample
setup_installer/Wed09d8d6edfaff2ac.exe
Resource
win7-en-20210920
Behavioral task
behavioral24
Sample
setup_installer/Wed09d8d6edfaff2ac.exe
Resource
win10-en-20211014
Behavioral task
behavioral25
Sample
setup_installer/Wed09db0d52c38.exe
Resource
win7-en-20210920
Behavioral task
behavioral26
Sample
setup_installer/Wed09db0d52c38.exe
Resource
win10-en-20210920
Behavioral task
behavioral27
Sample
setup_installer/Wed09e95ff6b5.exe
Resource
win7-en-20211014
Behavioral task
behavioral28
Sample
setup_installer/Wed09e95ff6b5.exe
Resource
win10-en-20210920
Behavioral task
behavioral29
Sample
setup_installer/Wed09f257bb7877d00b2.exe
Resource
win7-en-20211014
Behavioral task
behavioral30
Sample
setup_installer/Wed09f257bb7877d00b2.exe
Resource
win10-en-20210920
Behavioral task
behavioral31
Sample
setup_installer/libcurl.dll
Resource
win7-en-20211014
Behavioral task
behavioral32
Sample
setup_installer/libcurl.dll
Resource
win10-en-20210920
General
-
Target
setup_installer/Wed09b2a8bc4f16cb.exe
Malware Config
Extracted
smokeloader
2020
http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1304 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Wed09b2a8bc4f16cb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed09b2a8bc4f16cb.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed09b2a8bc4f16cb.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed09b2a8bc4f16cb.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Wed09b2a8bc4f16cb.exepid process 760 Wed09b2a8bc4f16cb.exe 760 Wed09b2a8bc4f16cb.exe 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1304 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Wed09b2a8bc4f16cb.exepid process 760 Wed09b2a8bc4f16cb.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1304 1304 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1304 1304
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/760-55-0x0000000002CA8000-0x0000000002CB9000-memory.dmpFilesize
68KB
-
memory/760-56-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/760-57-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB
-
memory/760-58-0x0000000000400000-0x0000000002BAA000-memory.dmpFilesize
39.7MB
-
memory/1304-59-0x00000000029B0000-0x00000000029C6000-memory.dmpFilesize
88KB