General
-
Target
64219f4d2644837ee3daa21509674404a8b316cfb6b80ed48fe98a4a534f94bd_x.exe
-
Size
273KB
-
Sample
240430-nv7ceabe3s
-
MD5
a7a476d82ccf49fcc87bfe5dd5a395a5
-
SHA1
0daa3664b2f86c3af059ca0c867bb1f928c760a2
-
SHA256
64219f4d2644837ee3daa21509674404a8b316cfb6b80ed48fe98a4a534f94bd
-
SHA512
57bc1426b272bb79993f10587bcee0608d176e439b324354edd09099fe6a004cc91544893dc317192db92ba0d18d84be656c55acb1c9a4f934f9260442ee90e4
-
SSDEEP
6144:TEk00KpwnNeKgygYzRwtbhlcu2p77wmV:T90twnN3eiAaumV
Static task
static1
Behavioral task
behavioral1
Sample
64219f4d2644837ee3daa21509674404a8b316cfb6b80ed48fe98a4a534f94bd_x.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
64219f4d2644837ee3daa21509674404a8b316cfb6b80ed48fe98a4a534f94bd_x.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php
Targets
-
-
Target
64219f4d2644837ee3daa21509674404a8b316cfb6b80ed48fe98a4a534f94bd_x.exe
-
Size
273KB
-
MD5
a7a476d82ccf49fcc87bfe5dd5a395a5
-
SHA1
0daa3664b2f86c3af059ca0c867bb1f928c760a2
-
SHA256
64219f4d2644837ee3daa21509674404a8b316cfb6b80ed48fe98a4a534f94bd
-
SHA512
57bc1426b272bb79993f10587bcee0608d176e439b324354edd09099fe6a004cc91544893dc317192db92ba0d18d84be656c55acb1c9a4f934f9260442ee90e4
-
SSDEEP
6144:TEk00KpwnNeKgygYzRwtbhlcu2p77wmV:T90twnN3eiAaumV
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1