Overview
overview
10Static
static
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
4ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
4ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10Resubmissions
12-11-2021 18:04
211112-wnzb8aahhm 1019-11-2020 10:08
201119-rhwlt38jrx 1018-11-2020 17:26
201118-htd4fq29va 10Analysis
-
max time kernel
1802s -
max time network
1811s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-11-2020 17:26
Static task
static1
Behavioral task
behavioral1
Sample
1.bin/1.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral2
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
31.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral4
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral6
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral8
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral10
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
HYDRA.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral12
Sample
Keygen.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral14
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral16
Sample
OnlineInstaller.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral18
Sample
SecurityTaskManager_Setup.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral20
Sample
VyprVPN.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
WSHSetup[1].exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral22
Sample
___ _ _____ __ ___/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
___ _ _____ __ ___/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral24
Sample
amtemu.v0.9.2.win-painter_edited.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
api.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral26
Sample
default.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral27
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral28
Sample
good.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral29
Sample
infected dot net installer.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral30
Sample
oof.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral31
Sample
ou55sg33s_1.exe
Resource
win10v20201028
windows10_x64
General
-
Target
HYDRA.exe
Malware Config
Extracted
smokeloader
2017
http://92.53.105.14/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 1612 created 3816 1612 svchost.exe 81 PID 1612 created 3816 1612 svchost.exe 81 -
Executes dropped EXE 10 IoCs
pid Process 752 yaya.exe 3564 va.exe 1784 ufx.exe 3112 sant.exe 3116 power.exe 3816 starter.exe 3728 usc.exe 1284 usc.exe 3732 usc.exe 3008 usc.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HDAudo.vbs va.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wow6432Node = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\vshtigjb\\ivdidjus.exe" explorer.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum sant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 sant.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3996 SCHTASKS.exe 3852 SCHTASKS.exe 2348 SCHTASKS.exe 1972 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe 3112 sant.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3112 sant.exe 3112 sant.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3728 usc.exe Token: SeTcbPrivilege 1612 svchost.exe Token: SeTcbPrivilege 1612 svchost.exe Token: SeDebugPrivilege 3816 starter.exe Token: SeDebugPrivilege 3988 powershell.exe Token: SeDebugPrivilege 1284 usc.exe Token: SeDebugPrivilege 3732 usc.exe Token: SeDebugPrivilege 3008 usc.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1924 wrote to memory of 752 1924 HYDRA.exe 75 PID 1924 wrote to memory of 752 1924 HYDRA.exe 75 PID 1924 wrote to memory of 752 1924 HYDRA.exe 75 PID 1924 wrote to memory of 3564 1924 HYDRA.exe 76 PID 1924 wrote to memory of 3564 1924 HYDRA.exe 76 PID 1924 wrote to memory of 3564 1924 HYDRA.exe 76 PID 1924 wrote to memory of 1784 1924 HYDRA.exe 77 PID 1924 wrote to memory of 1784 1924 HYDRA.exe 77 PID 1924 wrote to memory of 1784 1924 HYDRA.exe 77 PID 1924 wrote to memory of 3112 1924 HYDRA.exe 78 PID 1924 wrote to memory of 3112 1924 HYDRA.exe 78 PID 1924 wrote to memory of 3112 1924 HYDRA.exe 78 PID 1924 wrote to memory of 3116 1924 HYDRA.exe 79 PID 1924 wrote to memory of 3116 1924 HYDRA.exe 79 PID 1924 wrote to memory of 3116 1924 HYDRA.exe 79 PID 752 wrote to memory of 3816 752 yaya.exe 81 PID 752 wrote to memory of 3816 752 yaya.exe 81 PID 1784 wrote to memory of 3728 1784 ufx.exe 82 PID 1784 wrote to memory of 3728 1784 ufx.exe 82 PID 1784 wrote to memory of 3728 1784 ufx.exe 82 PID 3728 wrote to memory of 3996 3728 usc.exe 84 PID 3728 wrote to memory of 3996 3728 usc.exe 84 PID 3728 wrote to memory of 3996 3728 usc.exe 84 PID 3112 wrote to memory of 3012 3112 sant.exe 86 PID 3112 wrote to memory of 3012 3112 sant.exe 86 PID 3112 wrote to memory of 3012 3112 sant.exe 86 PID 3816 wrote to memory of 3552 3816 starter.exe 87 PID 3816 wrote to memory of 3552 3816 starter.exe 87 PID 3552 wrote to memory of 2240 3552 csc.exe 89 PID 3552 wrote to memory of 2240 3552 csc.exe 89 PID 1612 wrote to memory of 3808 1612 svchost.exe 91 PID 1612 wrote to memory of 3808 1612 svchost.exe 91 PID 1612 wrote to memory of 3800 1612 svchost.exe 92 PID 1612 wrote to memory of 3800 1612 svchost.exe 92 PID 3116 wrote to memory of 3988 3116 power.exe 96 PID 3116 wrote to memory of 3988 3116 power.exe 96 PID 3116 wrote to memory of 3988 3116 power.exe 96 PID 1284 wrote to memory of 3852 1284 usc.exe 99 PID 1284 wrote to memory of 3852 1284 usc.exe 99 PID 1284 wrote to memory of 3852 1284 usc.exe 99 PID 3732 wrote to memory of 2348 3732 usc.exe 102 PID 3732 wrote to memory of 2348 3732 usc.exe 102 PID 3732 wrote to memory of 2348 3732 usc.exe 102 PID 3008 wrote to memory of 1972 3008 usc.exe 105 PID 3008 wrote to memory of 1972 3008 usc.exe 105 PID 3008 wrote to memory of 1972 3008 usc.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\HYDRA.exe"C:\Users\Admin\AppData\Local\Temp\HYDRA.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Roaming\yaya.exeC:\Users\Admin\AppData\Roaming\yaya.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5egucrto.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2ADA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2AD9.tmp"5⤵PID:2240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:3808
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:3800
-
-
-
-
C:\Users\Admin\AppData\Roaming\va.exeC:\Users\Admin\AppData\Roaming\va.exe2⤵
- Executes dropped EXE
- Drops startup file
PID:3564
-
-
C:\Users\Admin\AppData\Roaming\ufx.exeC:\Users\Admin\AppData\Roaming\ufx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\ProgramData\ucp\usc.exe"C:\ProgramData\ucp\usc.exe" /ucp/usc.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe4⤵
- Creates scheduled task(s)
PID:3996
-
-
-
-
C:\Users\Admin\AppData\Roaming\sant.exeC:\Users\Admin\AppData\Roaming\sant.exe2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Adds Run key to start application
PID:3012
-
-
-
C:\Users\Admin\AppData\Roaming\power.exeC:\Users\Admin\AppData\Roaming\power.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3988
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
-
C:\ProgramData\ucp\usc.exeC:\ProgramData\ucp\usc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe2⤵
- Creates scheduled task(s)
PID:3852
-
-
C:\ProgramData\ucp\usc.exeC:\ProgramData\ucp\usc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe2⤵
- Creates scheduled task(s)
PID:2348
-
-
C:\ProgramData\ucp\usc.exeC:\ProgramData\ucp\usc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe2⤵
- Creates scheduled task(s)
PID:1972
-