Overview
overview
10Static
static
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
4ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
3Resubmissions
18-11-2020 14:18
201118-dj27sn3f52 1018-11-2020 13:42
201118-1arz86e7w6 1018-11-2020 13:38
201118-n8jh228ctn 10Analysis
-
max time kernel
1802s -
max time network
1813s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-11-2020 14:18
Static task
static1
Behavioral task
behavioral1
Sample
2019-09-02_22-41-10.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral2
Sample
31.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
3DMark 11 Advanced Edition.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral4
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral6
Sample
DiskInternals_Uneraser_v5_keygen.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
ForceOp 2.8.7 - By RaiSence.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral8
Sample
HYDRA.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
Keygen.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral10
Sample
LtHv0O2KZDK4M637.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
OnlineInstaller.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral12
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral14
Sample
VyprVPN.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
WSHSetup[1].bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral16
Sample
api.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral18
Sample
good.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
infected dot net installer.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral20
Sample
update.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
vir1.xls
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral22
Sample
xNet.dll
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
1.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral24
Sample
VPN/VyprVPN.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
VPN/xNet.dll
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral26
Sample
WSHSetup[1].bin.exe
Resource
win10v20201028
windows10_x64
General
-
Target
HYDRA.bin.exe
Malware Config
Extracted
smokeloader
2017
http://92.53.105.14/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 1640 created 3880 1640 svchost.exe 80 PID 1640 created 3880 1640 svchost.exe 80 -
Executes dropped EXE 10 IoCs
pid Process 2456 yaya.exe 2536 va.exe 2800 ufx.exe 3204 sant.exe 4072 power.exe 3880 starter.exe 2960 usc.exe 3952 usc.exe 4076 usc.exe 1192 usc.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HDAudo.vbs va.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\asjjtigb\\tbdvjsvi.exe" explorer.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum sant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 sant.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3608 SCHTASKS.exe 812 SCHTASKS.exe 3876 SCHTASKS.exe 3944 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe 3204 sant.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3204 sant.exe 3204 sant.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2960 usc.exe Token: SeTcbPrivilege 1640 svchost.exe Token: SeTcbPrivilege 1640 svchost.exe Token: SeDebugPrivilege 3880 starter.exe Token: SeDebugPrivilege 3676 powershell.exe Token: SeDebugPrivilege 3952 usc.exe Token: SeDebugPrivilege 4076 usc.exe Token: SeDebugPrivilege 1192 usc.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1876 wrote to memory of 2456 1876 HYDRA.bin.exe 74 PID 1876 wrote to memory of 2456 1876 HYDRA.bin.exe 74 PID 1876 wrote to memory of 2456 1876 HYDRA.bin.exe 74 PID 1876 wrote to memory of 2536 1876 HYDRA.bin.exe 75 PID 1876 wrote to memory of 2536 1876 HYDRA.bin.exe 75 PID 1876 wrote to memory of 2536 1876 HYDRA.bin.exe 75 PID 1876 wrote to memory of 2800 1876 HYDRA.bin.exe 76 PID 1876 wrote to memory of 2800 1876 HYDRA.bin.exe 76 PID 1876 wrote to memory of 2800 1876 HYDRA.bin.exe 76 PID 1876 wrote to memory of 3204 1876 HYDRA.bin.exe 77 PID 1876 wrote to memory of 3204 1876 HYDRA.bin.exe 77 PID 1876 wrote to memory of 3204 1876 HYDRA.bin.exe 77 PID 1876 wrote to memory of 4072 1876 HYDRA.bin.exe 78 PID 1876 wrote to memory of 4072 1876 HYDRA.bin.exe 78 PID 1876 wrote to memory of 4072 1876 HYDRA.bin.exe 78 PID 2456 wrote to memory of 3880 2456 yaya.exe 80 PID 2456 wrote to memory of 3880 2456 yaya.exe 80 PID 2800 wrote to memory of 2960 2800 ufx.exe 81 PID 2800 wrote to memory of 2960 2800 ufx.exe 81 PID 2800 wrote to memory of 2960 2800 ufx.exe 81 PID 2960 wrote to memory of 3608 2960 usc.exe 83 PID 2960 wrote to memory of 3608 2960 usc.exe 83 PID 2960 wrote to memory of 3608 2960 usc.exe 83 PID 3204 wrote to memory of 1332 3204 sant.exe 85 PID 3204 wrote to memory of 1332 3204 sant.exe 85 PID 3204 wrote to memory of 1332 3204 sant.exe 85 PID 3880 wrote to memory of 3200 3880 starter.exe 86 PID 3880 wrote to memory of 3200 3880 starter.exe 86 PID 3200 wrote to memory of 3936 3200 csc.exe 88 PID 3200 wrote to memory of 3936 3200 csc.exe 88 PID 1640 wrote to memory of 3268 1640 svchost.exe 90 PID 1640 wrote to memory of 3268 1640 svchost.exe 90 PID 1640 wrote to memory of 1012 1640 svchost.exe 91 PID 1640 wrote to memory of 1012 1640 svchost.exe 91 PID 4072 wrote to memory of 3676 4072 power.exe 95 PID 4072 wrote to memory of 3676 4072 power.exe 95 PID 4072 wrote to memory of 3676 4072 power.exe 95 PID 3952 wrote to memory of 812 3952 usc.exe 98 PID 3952 wrote to memory of 812 3952 usc.exe 98 PID 3952 wrote to memory of 812 3952 usc.exe 98 PID 4076 wrote to memory of 3876 4076 usc.exe 101 PID 4076 wrote to memory of 3876 4076 usc.exe 101 PID 4076 wrote to memory of 3876 4076 usc.exe 101 PID 1192 wrote to memory of 3944 1192 usc.exe 104 PID 1192 wrote to memory of 3944 1192 usc.exe 104 PID 1192 wrote to memory of 3944 1192 usc.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\HYDRA.bin.exe"C:\Users\Admin\AppData\Local\Temp\HYDRA.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Roaming\yaya.exeC:\Users\Admin\AppData\Roaming\yaya.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fu_ok1z6.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB9E1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB9E0.tmp"5⤵PID:3936
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:3268
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:1012
-
-
-
-
C:\Users\Admin\AppData\Roaming\va.exeC:\Users\Admin\AppData\Roaming\va.exe2⤵
- Executes dropped EXE
- Drops startup file
PID:2536
-
-
C:\Users\Admin\AppData\Roaming\ufx.exeC:\Users\Admin\AppData\Roaming\ufx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\ProgramData\ucp\usc.exe"C:\ProgramData\ucp\usc.exe" /ucp/usc.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe4⤵
- Creates scheduled task(s)
PID:3608
-
-
-
-
C:\Users\Admin\AppData\Roaming\sant.exeC:\Users\Admin\AppData\Roaming\sant.exe2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Adds Run key to start application
PID:1332
-
-
-
C:\Users\Admin\AppData\Roaming\power.exeC:\Users\Admin\AppData\Roaming\power.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
-
C:\ProgramData\ucp\usc.exeC:\ProgramData\ucp\usc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe2⤵
- Creates scheduled task(s)
PID:812
-
-
C:\ProgramData\ucp\usc.exeC:\ProgramData\ucp\usc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe2⤵
- Creates scheduled task(s)
PID:3876
-
-
C:\ProgramData\ucp\usc.exeC:\ProgramData\ucp\usc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe2⤵
- Creates scheduled task(s)
PID:3944
-