Analysis
-
max time kernel
151s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2023 01:35
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230220-en
General
-
Target
setup.exe
-
Size
305KB
-
MD5
7153a161818859a8793fd899129316e1
-
SHA1
0f7897476df446e2ebb5ab31288ec7326b94a5c3
-
SHA256
9f3c46c4d9856b0b6036e1798f1ad22d91ab5809ca97211373b962f0a05352ae
-
SHA512
8c9aecf79d598d391c2adb5d811c6ef875db8ab816cdf2652992c3b71a1d6f1c335e442cc54e9bab39a8b30918c1bae6d5d83499daf3c2bed45d113006eadea9
-
SSDEEP
3072:ZC+dcVZgf1DGAxOoGsY00UOH+yUs3nW+UfkSD7cWGQXBPSJEloTAWvQfo:NdLf1DlHG60UInlSDwnQXBl9
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
Processes:
sgwasjupid process 856 sgwasju -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
setup.exesgwasjudescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sgwasju Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sgwasju Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sgwasju -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
setup.exepid process 880 setup.exe 880 setup.exe 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 672 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 672 -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
setup.exesgwasjupid process 880 setup.exe 672 672 672 672 672 672 672 672 672 672 672 672 856 sgwasju 672 672 672 672 672 672 -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
description pid process target process PID 672 wrote to memory of 732 672 explorer.exe PID 672 wrote to memory of 732 672 explorer.exe PID 672 wrote to memory of 732 672 explorer.exe PID 672 wrote to memory of 732 672 explorer.exe PID 672 wrote to memory of 1320 672 explorer.exe PID 672 wrote to memory of 1320 672 explorer.exe PID 672 wrote to memory of 1320 672 explorer.exe PID 672 wrote to memory of 2336 672 explorer.exe PID 672 wrote to memory of 2336 672 explorer.exe PID 672 wrote to memory of 2336 672 explorer.exe PID 672 wrote to memory of 2336 672 explorer.exe PID 672 wrote to memory of 2276 672 explorer.exe PID 672 wrote to memory of 2276 672 explorer.exe PID 672 wrote to memory of 2276 672 explorer.exe PID 672 wrote to memory of 548 672 explorer.exe PID 672 wrote to memory of 548 672 explorer.exe PID 672 wrote to memory of 548 672 explorer.exe PID 672 wrote to memory of 548 672 explorer.exe PID 672 wrote to memory of 100 672 explorer.exe PID 672 wrote to memory of 100 672 explorer.exe PID 672 wrote to memory of 100 672 explorer.exe PID 672 wrote to memory of 100 672 explorer.exe PID 672 wrote to memory of 3220 672 explorer.exe PID 672 wrote to memory of 3220 672 explorer.exe PID 672 wrote to memory of 3220 672 explorer.exe PID 672 wrote to memory of 3220 672 explorer.exe PID 672 wrote to memory of 3184 672 explorer.exe PID 672 wrote to memory of 3184 672 explorer.exe PID 672 wrote to memory of 3184 672 explorer.exe PID 672 wrote to memory of 4396 672 explorer.exe PID 672 wrote to memory of 4396 672 explorer.exe PID 672 wrote to memory of 4396 672 explorer.exe PID 672 wrote to memory of 4396 672 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\sgwasjuC:\Users\Admin\AppData\Roaming\sgwasju1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\sgwasjuFilesize
305KB
MD57153a161818859a8793fd899129316e1
SHA10f7897476df446e2ebb5ab31288ec7326b94a5c3
SHA2569f3c46c4d9856b0b6036e1798f1ad22d91ab5809ca97211373b962f0a05352ae
SHA5128c9aecf79d598d391c2adb5d811c6ef875db8ab816cdf2652992c3b71a1d6f1c335e442cc54e9bab39a8b30918c1bae6d5d83499daf3c2bed45d113006eadea9
-
C:\Users\Admin\AppData\Roaming\sgwasjuFilesize
305KB
MD57153a161818859a8793fd899129316e1
SHA10f7897476df446e2ebb5ab31288ec7326b94a5c3
SHA2569f3c46c4d9856b0b6036e1798f1ad22d91ab5809ca97211373b962f0a05352ae
SHA5128c9aecf79d598d391c2adb5d811c6ef875db8ab816cdf2652992c3b71a1d6f1c335e442cc54e9bab39a8b30918c1bae6d5d83499daf3c2bed45d113006eadea9
-
memory/100-185-0x00000000007A0000-0x00000000007A5000-memory.dmpFilesize
20KB
-
memory/100-170-0x0000000000790000-0x0000000000799000-memory.dmpFilesize
36KB
-
memory/100-164-0x0000000000790000-0x0000000000799000-memory.dmpFilesize
36KB
-
memory/100-169-0x00000000007A0000-0x00000000007A5000-memory.dmpFilesize
20KB
-
memory/548-162-0x0000000000D50000-0x0000000000D72000-memory.dmpFilesize
136KB
-
memory/548-161-0x0000000000D20000-0x0000000000D47000-memory.dmpFilesize
156KB
-
memory/548-163-0x0000000000D20000-0x0000000000D47000-memory.dmpFilesize
156KB
-
memory/548-184-0x0000000000D50000-0x0000000000D72000-memory.dmpFilesize
136KB
-
memory/672-135-0x0000000000D00000-0x0000000000D16000-memory.dmpFilesize
88KB
-
memory/672-165-0x0000000002AD0000-0x0000000002AE6000-memory.dmpFilesize
88KB
-
memory/732-151-0x0000000000790000-0x000000000079B000-memory.dmpFilesize
44KB
-
memory/732-180-0x00000000007A0000-0x00000000007A7000-memory.dmpFilesize
28KB
-
memory/732-150-0x00000000007A0000-0x00000000007A7000-memory.dmpFilesize
28KB
-
memory/732-148-0x0000000000790000-0x000000000079B000-memory.dmpFilesize
44KB
-
memory/856-168-0x0000000000400000-0x0000000002B79000-memory.dmpFilesize
39.5MB
-
memory/880-134-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/880-136-0x0000000000400000-0x0000000002B79000-memory.dmpFilesize
39.5MB
-
memory/1320-154-0x0000000000930000-0x000000000093F000-memory.dmpFilesize
60KB
-
memory/1320-152-0x0000000000930000-0x000000000093F000-memory.dmpFilesize
60KB
-
memory/1320-153-0x0000000000940000-0x0000000000949000-memory.dmpFilesize
36KB
-
memory/1320-181-0x0000000000940000-0x0000000000949000-memory.dmpFilesize
36KB
-
memory/2276-160-0x00000000001B0000-0x00000000001BC000-memory.dmpFilesize
48KB
-
memory/2276-158-0x00000000001B0000-0x00000000001BC000-memory.dmpFilesize
48KB
-
memory/2276-183-0x00000000001C0000-0x00000000001C6000-memory.dmpFilesize
24KB
-
memory/2276-159-0x00000000001C0000-0x00000000001C6000-memory.dmpFilesize
24KB
-
memory/2336-155-0x0000000000D60000-0x0000000000D69000-memory.dmpFilesize
36KB
-
memory/2336-157-0x0000000000D60000-0x0000000000D69000-memory.dmpFilesize
36KB
-
memory/2336-156-0x0000000000D70000-0x0000000000D75000-memory.dmpFilesize
20KB
-
memory/2336-182-0x0000000000D70000-0x0000000000D75000-memory.dmpFilesize
20KB
-
memory/3184-176-0x0000000001210000-0x000000000121D000-memory.dmpFilesize
52KB
-
memory/3184-175-0x0000000001220000-0x0000000001227000-memory.dmpFilesize
28KB
-
memory/3184-174-0x0000000001210000-0x000000000121D000-memory.dmpFilesize
52KB
-
memory/3184-187-0x0000000001220000-0x0000000001227000-memory.dmpFilesize
28KB
-
memory/3220-173-0x00000000010F0000-0x00000000010FB000-memory.dmpFilesize
44KB
-
memory/3220-172-0x0000000001100000-0x0000000001106000-memory.dmpFilesize
24KB
-
memory/3220-171-0x00000000010F0000-0x00000000010FB000-memory.dmpFilesize
44KB
-
memory/3220-186-0x0000000001100000-0x0000000001106000-memory.dmpFilesize
24KB
-
memory/4396-178-0x00000000010E0000-0x00000000010E8000-memory.dmpFilesize
32KB
-
memory/4396-179-0x00000000010D0000-0x00000000010DB000-memory.dmpFilesize
44KB
-
memory/4396-177-0x00000000010D0000-0x00000000010DB000-memory.dmpFilesize
44KB
-
memory/4396-188-0x00000000010E0000-0x00000000010E8000-memory.dmpFilesize
32KB