Overview
overview
10Static
static
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8Analysis
-
max time kernel
1803s -
max time network
1815s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-11-2020 13:14
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v20201028
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
1.bin/1.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win10v20201028
Behavioral task
behavioral6
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
31.exe
Resource
win10v20201028
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v20201028
Behavioral task
behavioral10
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
Behavioral task
behavioral12
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v20201028
Behavioral task
behavioral14
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v20201028
Behavioral task
behavioral16
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v20201028
Behavioral task
behavioral17
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
Behavioral task
behavioral18
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
Behavioral task
behavioral19
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win10v20201028
Behavioral task
behavioral20
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
Behavioral task
behavioral22
Sample
HYDRA.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
KLwC6vii.exe
Resource
win10v20201028
Behavioral task
behavioral24
Sample
Keygen.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
Behavioral task
behavioral26
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral28
Sample
OnlineInstaller.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v20201028
Behavioral task
behavioral30
Sample
SecuriteInfo.com.Gen.NN.ZexaF.34108.xy1@amqiedE.17985.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
SecuriteInfo.com.Generic.mg.cde56cf0169830ee.29869.dll
Resource
win10v20201028
General
-
Target
HYDRA.exe
Malware Config
Extracted
smokeloader
2017
http://92.53.105.14/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess ⋅ 2 IoCs
Processes:
svchost.exedescription pid process target process PID 2888 created 2920 2888 svchost.exe starter.exe PID 2888 created 2920 2888 svchost.exe starter.exe -
Executes dropped EXE ⋅ 10 IoCs
Processes:
yaya.exeva.exeufx.exesant.exepower.exestarter.exeusc.exeusc.exeusc.exeusc.exepid process 2696 yaya.exe 2684 va.exe 2824 ufx.exe 3828 sant.exe 3388 power.exe 2920 starter.exe 1832 usc.exe 3744 usc.exe 1100 usc.exe 364 usc.exe -
Drops startup file ⋅ 1 IoCs
Processes:
va.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HDAudo.vbs va.exe -
Adds Run key to start application ⋅ 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\ftrfffwb\\rrcfcdif.exe" explorer.exe -
Maps connected drives based on registry ⋅ 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
sant.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum sant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 sant.exe -
Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) ⋅ 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
TTPs:
Processes:
SCHTASKS.exeSCHTASKS.exeSCHTASKS.exeSCHTASKS.exepid process 3980 SCHTASKS.exe 212 SCHTASKS.exe 640 SCHTASKS.exe 4004 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
Processes:
sant.exepid process 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe 3828 sant.exe -
Suspicious behavior: MapViewOfSection ⋅ 2 IoCs
Processes:
sant.exepid process 3828 sant.exe 3828 sant.exe -
Suspicious use of AdjustPrivilegeToken ⋅ 8 IoCs
Processes:
usc.exesvchost.exestarter.exepowershell.exeusc.exeusc.exeusc.exedescription pid process Token: SeDebugPrivilege 1832 usc.exe Token: SeTcbPrivilege 2888 svchost.exe Token: SeTcbPrivilege 2888 svchost.exe Token: SeDebugPrivilege 2920 starter.exe Token: SeDebugPrivilege 1152 powershell.exe Token: SeDebugPrivilege 3744 usc.exe Token: SeDebugPrivilege 1100 usc.exe Token: SeDebugPrivilege 364 usc.exe -
Suspicious use of WriteProcessMemory ⋅ 46 IoCs
Processes:
HYDRA.exeufx.exeyaya.exeusc.exestarter.execsc.exesvchost.exesant.exepower.exeusc.exeusc.exeusc.exedescription pid process target process PID 4092 wrote to memory of 2696 4092 HYDRA.exe yaya.exe PID 4092 wrote to memory of 2696 4092 HYDRA.exe yaya.exe PID 4092 wrote to memory of 2696 4092 HYDRA.exe yaya.exe PID 4092 wrote to memory of 2684 4092 HYDRA.exe va.exe PID 4092 wrote to memory of 2684 4092 HYDRA.exe va.exe PID 4092 wrote to memory of 2684 4092 HYDRA.exe va.exe PID 4092 wrote to memory of 2824 4092 HYDRA.exe ufx.exe PID 4092 wrote to memory of 2824 4092 HYDRA.exe ufx.exe PID 4092 wrote to memory of 2824 4092 HYDRA.exe ufx.exe PID 4092 wrote to memory of 3828 4092 HYDRA.exe sant.exe PID 4092 wrote to memory of 3828 4092 HYDRA.exe sant.exe PID 4092 wrote to memory of 3828 4092 HYDRA.exe sant.exe PID 4092 wrote to memory of 3388 4092 HYDRA.exe power.exe PID 4092 wrote to memory of 3388 4092 HYDRA.exe power.exe PID 4092 wrote to memory of 3388 4092 HYDRA.exe power.exe PID 2824 wrote to memory of 1832 2824 ufx.exe usc.exe PID 2824 wrote to memory of 1832 2824 ufx.exe usc.exe PID 2824 wrote to memory of 1832 2824 ufx.exe usc.exe PID 2696 wrote to memory of 2920 2696 yaya.exe starter.exe PID 2696 wrote to memory of 2920 2696 yaya.exe starter.exe PID 1832 wrote to memory of 212 1832 usc.exe SCHTASKS.exe PID 1832 wrote to memory of 212 1832 usc.exe SCHTASKS.exe PID 1832 wrote to memory of 212 1832 usc.exe SCHTASKS.exe PID 2920 wrote to memory of 1560 2920 starter.exe csc.exe PID 2920 wrote to memory of 1560 2920 starter.exe csc.exe PID 1560 wrote to memory of 556 1560 csc.exe cvtres.exe PID 1560 wrote to memory of 556 1560 csc.exe cvtres.exe PID 2888 wrote to memory of 2912 2888 svchost.exe cmd.exe PID 2888 wrote to memory of 2912 2888 svchost.exe cmd.exe PID 2888 wrote to memory of 4016 2888 svchost.exe cmd.exe PID 2888 wrote to memory of 4016 2888 svchost.exe cmd.exe PID 3828 wrote to memory of 2848 3828 sant.exe explorer.exe PID 3828 wrote to memory of 2848 3828 sant.exe explorer.exe PID 3828 wrote to memory of 2848 3828 sant.exe explorer.exe PID 3388 wrote to memory of 1152 3388 power.exe powershell.exe PID 3388 wrote to memory of 1152 3388 power.exe powershell.exe PID 3388 wrote to memory of 1152 3388 power.exe powershell.exe PID 3744 wrote to memory of 640 3744 usc.exe SCHTASKS.exe PID 3744 wrote to memory of 640 3744 usc.exe SCHTASKS.exe PID 3744 wrote to memory of 640 3744 usc.exe SCHTASKS.exe PID 1100 wrote to memory of 4004 1100 usc.exe SCHTASKS.exe PID 1100 wrote to memory of 4004 1100 usc.exe SCHTASKS.exe PID 1100 wrote to memory of 4004 1100 usc.exe SCHTASKS.exe PID 364 wrote to memory of 3980 364 usc.exe SCHTASKS.exe PID 364 wrote to memory of 3980 364 usc.exe SCHTASKS.exe PID 364 wrote to memory of 3980 364 usc.exe SCHTASKS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HYDRA.exePID:4092"C:\Users\Admin\AppData\Local\Temp\HYDRA.exe"Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\yaya.exePID:2696C:\Users\Admin\AppData\Roaming\yaya.exeExecutes dropped EXESuspicious use of WriteProcessMemory
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exePID:2920"C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"Executes dropped EXESuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exePID:1560"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qg_8qucl.cmdline"Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exePID:556C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES912B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC912A.tmp"
-
C:\Windows\System32\cmd.exePID:2912"C:\Windows\System32\cmd.exe"
-
C:\Windows\System32\cmd.exePID:4016"C:\Windows\System32\cmd.exe"
-
C:\Users\Admin\AppData\Roaming\va.exePID:2684C:\Users\Admin\AppData\Roaming\va.exeExecutes dropped EXEDrops startup file
-
C:\Users\Admin\AppData\Roaming\ufx.exePID:2824C:\Users\Admin\AppData\Roaming\ufx.exeExecutes dropped EXESuspicious use of WriteProcessMemory
-
C:\ProgramData\ucp\usc.exePID:1832"C:\ProgramData\ucp\usc.exe" /ucp/usc.exeExecutes dropped EXESuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SCHTASKS.exePID:212SCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exeCreates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\sant.exePID:3828C:\Users\Admin\AppData\Roaming\sant.exeExecutes dropped EXEMaps connected drives based on registrySuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exePID:2848explorer.exeAdds Run key to start application
-
C:\Users\Admin\AppData\Roaming\power.exePID:3388C:\Users\Admin\AppData\Roaming\power.exeExecutes dropped EXESuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePID:1152"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exePID:2888c:\windows\system32\svchost.exe -k netsvcs -s seclogonSuspicious use of NtCreateUserProcessOtherParentProcessSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\ProgramData\ucp\usc.exePID:3744C:\ProgramData\ucp\usc.exeExecutes dropped EXESuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SCHTASKS.exePID:640SCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exeCreates scheduled task(s)
-
C:\ProgramData\ucp\usc.exePID:1100C:\ProgramData\ucp\usc.exeExecutes dropped EXESuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SCHTASKS.exePID:4004SCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exeCreates scheduled task(s)
-
C:\ProgramData\ucp\usc.exePID:364C:\ProgramData\ucp\usc.exeExecutes dropped EXESuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SCHTASKS.exePID:3980SCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exeCreates scheduled task(s)
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
C:\ProgramData\ucp\usc.exe
-
C:\ProgramData\ucp\usc.exe
-
C:\ProgramData\ucp\usc.exe
-
C:\ProgramData\ucp\usc.exe
-
C:\ProgramData\ucp\usc.exe
-
C:\Users\Admin\AppData\Local\Temp\RES912B.tmp
-
C:\Users\Admin\AppData\Local\Temp\qg_8qucl.dll
-
C:\Users\Admin\AppData\Local\Temp\qg_8qucl.pdb
-
C:\Users\Admin\AppData\Roaming\power.exe
-
C:\Users\Admin\AppData\Roaming\power.exe
-
C:\Users\Admin\AppData\Roaming\sant.exe
-
C:\Users\Admin\AppData\Roaming\sant.exe
-
C:\Users\Admin\AppData\Roaming\ufx.exe
-
C:\Users\Admin\AppData\Roaming\ufx.exe
-
C:\Users\Admin\AppData\Roaming\va.exe
-
C:\Users\Admin\AppData\Roaming\va.exe
-
C:\Users\Admin\AppData\Roaming\yaya.exe
-
C:\Users\Admin\AppData\Roaming\yaya.exe
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe
-
\??\c:\Users\Admin\AppData\Local\Temp\CSC912A.tmp
-
\??\c:\Users\Admin\AppData\Local\Temp\qg_8qucl.0.cs
-
\??\c:\Users\Admin\AppData\Local\Temp\qg_8qucl.cmdline
-
memory/212-22-0x0000000000000000-mapping.dmp
-
memory/556-26-0x0000000000000000-mapping.dmp
-
memory/640-47-0x0000000000000000-mapping.dmp
-
memory/1152-43-0x00000000083E0000-0x00000000083E1000-memory.dmp
-
memory/1152-45-0x00000000094D0000-0x00000000094D1000-memory.dmp
-
memory/1152-44-0x00000000087F0000-0x00000000087F1000-memory.dmp
-
memory/1152-42-0x0000000008370000-0x0000000008371000-memory.dmp
-
memory/1152-41-0x0000000008000000-0x0000000008001000-memory.dmp
-
memory/1152-40-0x0000000007F90000-0x0000000007F91000-memory.dmp
-
memory/1152-39-0x0000000007DC0000-0x0000000007DC1000-memory.dmp
-
memory/1152-38-0x00000000074E0000-0x00000000074E1000-memory.dmp
-
memory/1152-34-0x0000000000000000-mapping.dmp
-
memory/1152-35-0x0000000071BC0000-0x00000000722AE000-memory.dmp
-
memory/1152-36-0x0000000006F00000-0x0000000006F01000-memory.dmp
-
memory/1152-37-0x0000000007690000-0x0000000007691000-memory.dmp
-
memory/1560-23-0x0000000000000000-mapping.dmp
-
memory/1832-18-0x0000000000000000-mapping.dmp
-
memory/2684-2-0x0000000000000000-mapping.dmp
-
memory/2696-0-0x0000000000000000-mapping.dmp
-
memory/2824-4-0x0000000000000000-mapping.dmp
-
memory/2848-31-0x0000000000000000-mapping.dmp
-
memory/2848-33-0x0000000000B90000-0x0000000000FCF000-memory.dmp
-
memory/2848-32-0x0000000000B90000-0x0000000000FCF000-memory.dmp
-
memory/2920-15-0x0000000000000000-mapping.dmp
-
memory/2920-21-0x00007FFFCF010000-0x00007FFFCF9B0000-memory.dmp
-
memory/3388-12-0x0000000000000000-mapping.dmp
-
memory/3828-9-0x0000000000000000-mapping.dmp
-
memory/3980-51-0x0000000000000000-mapping.dmp
-
memory/4004-49-0x0000000000000000-mapping.dmp