Overview
overview
10Static
static
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
9ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
Analysis
-
max time kernel
1801s -
max time network
1811s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-11-2020 14:34
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.exe.dll
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral4
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral6
Sample
31.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral8
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral10
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral12
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.exe.dll
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral14
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral16
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral18
Sample
HYDRA.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
KLwC6vii.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral20
Sample
Keygen.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral22
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral24
Sample
OnlineInstaller.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v20201028
windows10_x64
windows10_x64
Behavioral task
behavioral27
Sample
SecuriteInfo.com.Generic.mg.cde56cf0169830ee.29869.dll
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral28
Sample
SecurityTaskManager_Setup.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral29
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral30
Sample
VyprVPN.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral31
Sample
WSHSetup[1].exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral32
Sample
Yard.dll
Resource
win10v20201028
windows10_x64
General
-
Target
HYDRA.exe
Malware Config
Extracted
smokeloader
2017
http://92.53.105.14/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 1364 created 2128 1364 svchost.exe 80 PID 1364 created 2128 1364 svchost.exe 80 -
Executes dropped EXE 10 IoCs
pid Process 1492 yaya.exe 1632 va.exe 1960 ufx.exe 2084 sant.exe 2348 power.exe 2128 starter.exe 2256 usc.exe 3208 usc.exe 4000 usc.exe 888 usc.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HDAudo.vbs va.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Classes = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\drsiwwwu\\artshvwi.exe" explorer.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum sant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 sant.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2160 SCHTASKS.exe 2200 SCHTASKS.exe 2284 SCHTASKS.exe 2684 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe 2084 sant.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2084 sant.exe 2084 sant.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2256 usc.exe Token: SeTcbPrivilege 1364 svchost.exe Token: SeTcbPrivilege 1364 svchost.exe Token: SeDebugPrivilege 2128 starter.exe Token: SeDebugPrivilege 3292 powershell.exe Token: SeDebugPrivilege 3208 usc.exe Token: SeDebugPrivilege 4000 usc.exe Token: SeDebugPrivilege 888 usc.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 4040 wrote to memory of 1492 4040 HYDRA.exe 73 PID 4040 wrote to memory of 1492 4040 HYDRA.exe 73 PID 4040 wrote to memory of 1492 4040 HYDRA.exe 73 PID 4040 wrote to memory of 1632 4040 HYDRA.exe 74 PID 4040 wrote to memory of 1632 4040 HYDRA.exe 74 PID 4040 wrote to memory of 1632 4040 HYDRA.exe 74 PID 4040 wrote to memory of 1960 4040 HYDRA.exe 75 PID 4040 wrote to memory of 1960 4040 HYDRA.exe 75 PID 4040 wrote to memory of 1960 4040 HYDRA.exe 75 PID 4040 wrote to memory of 2084 4040 HYDRA.exe 76 PID 4040 wrote to memory of 2084 4040 HYDRA.exe 76 PID 4040 wrote to memory of 2084 4040 HYDRA.exe 76 PID 4040 wrote to memory of 2348 4040 HYDRA.exe 77 PID 4040 wrote to memory of 2348 4040 HYDRA.exe 77 PID 4040 wrote to memory of 2348 4040 HYDRA.exe 77 PID 1492 wrote to memory of 2128 1492 yaya.exe 80 PID 1492 wrote to memory of 2128 1492 yaya.exe 80 PID 1960 wrote to memory of 2256 1960 ufx.exe 81 PID 1960 wrote to memory of 2256 1960 ufx.exe 81 PID 1960 wrote to memory of 2256 1960 ufx.exe 81 PID 2256 wrote to memory of 2160 2256 usc.exe 83 PID 2256 wrote to memory of 2160 2256 usc.exe 83 PID 2256 wrote to memory of 2160 2256 usc.exe 83 PID 2128 wrote to memory of 2940 2128 starter.exe 85 PID 2128 wrote to memory of 2940 2128 starter.exe 85 PID 2940 wrote to memory of 1380 2940 csc.exe 87 PID 2940 wrote to memory of 1380 2940 csc.exe 87 PID 1364 wrote to memory of 2488 1364 svchost.exe 89 PID 1364 wrote to memory of 2488 1364 svchost.exe 89 PID 1364 wrote to memory of 2484 1364 svchost.exe 90 PID 1364 wrote to memory of 2484 1364 svchost.exe 90 PID 2084 wrote to memory of 200 2084 sant.exe 94 PID 2084 wrote to memory of 200 2084 sant.exe 94 PID 2084 wrote to memory of 200 2084 sant.exe 94 PID 2348 wrote to memory of 3292 2348 power.exe 95 PID 2348 wrote to memory of 3292 2348 power.exe 95 PID 2348 wrote to memory of 3292 2348 power.exe 95 PID 3208 wrote to memory of 2200 3208 usc.exe 98 PID 3208 wrote to memory of 2200 3208 usc.exe 98 PID 3208 wrote to memory of 2200 3208 usc.exe 98 PID 4000 wrote to memory of 2284 4000 usc.exe 101 PID 4000 wrote to memory of 2284 4000 usc.exe 101 PID 4000 wrote to memory of 2284 4000 usc.exe 101 PID 888 wrote to memory of 2684 888 usc.exe 104 PID 888 wrote to memory of 2684 888 usc.exe 104 PID 888 wrote to memory of 2684 888 usc.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\HYDRA.exe"C:\Users\Admin\AppData\Local\Temp\HYDRA.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Roaming\yaya.exeC:\Users\Admin\AppData\Roaming\yaya.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ztojiw2t.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES771B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC771A.tmp"5⤵PID:1380
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:2488
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:2484
-
-
-
-
C:\Users\Admin\AppData\Roaming\va.exeC:\Users\Admin\AppData\Roaming\va.exe2⤵
- Executes dropped EXE
- Drops startup file
PID:1632
-
-
C:\Users\Admin\AppData\Roaming\ufx.exeC:\Users\Admin\AppData\Roaming\ufx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\ProgramData\ucp\usc.exe"C:\ProgramData\ucp\usc.exe" /ucp/usc.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe4⤵
- Creates scheduled task(s)
PID:2160
-
-
-
-
C:\Users\Admin\AppData\Roaming\sant.exeC:\Users\Admin\AppData\Roaming\sant.exe2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Adds Run key to start application
PID:200
-
-
-
C:\Users\Admin\AppData\Roaming\power.exeC:\Users\Admin\AppData\Roaming\power.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3292
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364
-
C:\ProgramData\ucp\usc.exeC:\ProgramData\ucp\usc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe2⤵
- Creates scheduled task(s)
PID:2200
-
-
C:\ProgramData\ucp\usc.exeC:\ProgramData\ucp\usc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe2⤵
- Creates scheduled task(s)
PID:2284
-
-
C:\ProgramData\ucp\usc.exeC:\ProgramData\ucp\usc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe2⤵
- Creates scheduled task(s)
PID:2684
-