Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-04-2023 00:23
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230220-en
General
-
Target
setup.exe
-
Size
237KB
-
MD5
808bb423cce6dc2b2b1cf053032582ba
-
SHA1
512ceec6fcf045330d15a906c3d7718e746d5c11
-
SHA256
647afe227b07e0b2eee651cf8273b18a225a306c1bfc46119de5d1f6459db409
-
SHA512
3a82c6a44f694889327c2877fed4b53c1370219a41853031136ec6b42977ba8f9415c6c2fbd34653fb68bf0db50142a54590dc078540a2a5eaf5e79787bc8a7a
-
SSDEEP
3072:ytPKwWzVvYj1pOFxwqKjC1vth13AAZ5YR3HrJBxQ/:4Cw0y1pmVK4v313AAsZZ
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
setup.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI setup.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
setup.exepid process 2004 setup.exe 2004 setup.exe 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1208 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
setup.exepid process 2004 setup.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-56-0x0000000002A80000-0x0000000002A96000-memory.dmpFilesize
88KB
-
memory/1208-60-0x000007FE87360000-0x000007FE8736A000-memory.dmpFilesize
40KB
-
memory/2004-55-0x00000000003D0000-0x00000000003D9000-memory.dmpFilesize
36KB
-
memory/2004-57-0x0000000000400000-0x0000000002BA4000-memory.dmpFilesize
39.6MB