Analysis
-
max time kernel
151s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-04-2023 01:59
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230220-en
General
-
Target
setup.exe
-
Size
250KB
-
MD5
d169e14da76d2ea1c5f28a8c725200bc
-
SHA1
67ff0250b3ef18dafb0957844360dd004e6a2ec0
-
SHA256
4c7078aedb3350821a7ac2b11b821b70ce6f689f2d964f93763cee700fae60b1
-
SHA512
2de66eb4b887dbc873f3db1a0712f880f8b7bf198f1ec9e5a3be189f07ece04189b9c54a87e35f70453243af7f4528ed7105b46279d72fbe2e5bf2cb8c3e38f1
-
SSDEEP
3072:O5ZRRFQdp8XA+RmcH6ui/m3y5Q3AwPDZETUWGby7eFmMACBg9Ifxv:mRRO4A+tGm3yklPDySUXSZ
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
setup.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
setup.exepid process 1516 setup.exe 1516 setup.exe 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 1240 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1240 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
setup.exepid process 1516 setup.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1240-56-0x0000000002B20000-0x0000000002B36000-memory.dmpFilesize
88KB
-
memory/1240-60-0x000007FF0C940000-0x000007FF0C94A000-memory.dmpFilesize
40KB
-
memory/1516-55-0x00000000003D0000-0x00000000003D9000-memory.dmpFilesize
36KB
-
memory/1516-57-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB