Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-03-2023 01:07
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230220-en
General
-
Target
setup.exe
-
Size
274KB
-
MD5
a1c240e28cf9828fe5adc68119a57fa6
-
SHA1
0afbabe69316a1b24c1fc374e58247b14a821cc3
-
SHA256
0e48989c3c279086632f0bfb9fe7e49eee62ac6b8222d210828f2d1b42f22541
-
SHA512
3292e4b02639c3b61426eba6c9dbfab3d9dd17d46b095d1c64f6dc080bf5c1025932ddfe614207a8c57b6bd0dabe95e55ac852b83215c790d132aa681173c61b
-
SSDEEP
3072:93lo2E9NTud8WxIYW0ukE0bZE2eU80ZRP7DYmfwf0Uo95FvhdFjIvP/7xpNN4TJY:ihXW+YWUg0ZRDDYmfHL1lIX/7jNN4T
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
setup.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
setup.exepid process 1344 setup.exe 1344 setup.exe 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1204 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
setup.exepid process 1344 setup.exe