Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
24-09-2022 17:08
Static task
static1
Behavioral task
behavioral1
Sample
66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exe
Resource
win10-20220812-en
General
-
Target
66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exe
-
Size
198KB
-
MD5
a2f48d20a213b968e82201ef20621f38
-
SHA1
c7578d5922e1b91259191fd64bc20bb8c7f4efff
-
SHA256
66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00
-
SHA512
7c4eca440559be3fb48778b1ad9a22ab9cb78c4ac509d4b09e03bcff8fd695e2a01edfc1942a9637d10b26c5ede60327cee385a969f0af093ea9861d4ba23fcf
-
SSDEEP
3072:IFE+wLFFcMhpA5NfI02eaFpk5pBgj0SwFR+4j4O8BgcR/Pkk4x:dLFphG2eaFpCpBgjLqRDXc
Malware Config
Extracted
danabot
198.15.112.179:443
185.62.56.245:443
153.92.223.225:443
192.119.70.159:443
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3540-143-0x00000000006F0000-0x00000000006F9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
1F.exegfvcsvtpid process 1568 1F.exe 1328 gfvcsvt -
Deletes itself 1 IoCs
Processes:
pid process 2112 -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3936 1568 WerFault.exe 1F.exe 4012 1568 WerFault.exe 1F.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
gfvcsvt66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gfvcsvt Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gfvcsvt Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gfvcsvt -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exepid process 3540 66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exe 3540 66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exe 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 2112 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2112 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exegfvcsvtpid process 3540 66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exe 1328 gfvcsvt -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2112 Token: SeCreatePagefilePrivilege 2112 Token: SeShutdownPrivilege 2112 Token: SeCreatePagefilePrivilege 2112 Token: SeShutdownPrivilege 2112 Token: SeCreatePagefilePrivilege 2112 Token: SeShutdownPrivilege 2112 Token: SeCreatePagefilePrivilege 2112 -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
1F.exedescription pid process target process PID 2112 wrote to memory of 1568 2112 1F.exe PID 2112 wrote to memory of 1568 2112 1F.exe PID 2112 wrote to memory of 1568 2112 1F.exe PID 1568 wrote to memory of 4320 1568 1F.exe appidtel.exe PID 1568 wrote to memory of 4320 1568 1F.exe appidtel.exe PID 1568 wrote to memory of 4320 1568 1F.exe appidtel.exe PID 1568 wrote to memory of 4196 1568 1F.exe rundll32.exe PID 1568 wrote to memory of 4196 1568 1F.exe rundll32.exe PID 1568 wrote to memory of 4196 1568 1F.exe rundll32.exe PID 1568 wrote to memory of 4196 1568 1F.exe rundll32.exe PID 1568 wrote to memory of 4196 1568 1F.exe rundll32.exe PID 1568 wrote to memory of 4196 1568 1F.exe rundll32.exe PID 1568 wrote to memory of 4196 1568 1F.exe rundll32.exe PID 1568 wrote to memory of 4196 1568 1F.exe rundll32.exe PID 1568 wrote to memory of 4196 1568 1F.exe rundll32.exe PID 1568 wrote to memory of 4196 1568 1F.exe rundll32.exe PID 1568 wrote to memory of 4196 1568 1F.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exe"C:\Users\Admin\AppData\Local\Temp\66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1F.exeC:\Users\Admin\AppData\Local\Temp\1F.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 6002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 6322⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\gfvcsvtC:\Users\Admin\AppData\Roaming\gfvcsvt1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1F.exeFilesize
1.3MB
MD538ba7056d233e336378d7d0f9228c9c4
SHA18ef3721c27c92928292af285b0e3f9a36e70668b
SHA25628e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb
SHA5122d95800224280634ccee934d91bdb2d307e39c794b10151b1caa8712f0c1cac12741d34e17fe8d2abf3706f0250e29b1f5f299cd59d3e64cb927ae534fffb508
-
C:\Users\Admin\AppData\Local\Temp\1F.exeFilesize
1.3MB
MD538ba7056d233e336378d7d0f9228c9c4
SHA18ef3721c27c92928292af285b0e3f9a36e70668b
SHA25628e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb
SHA5122d95800224280634ccee934d91bdb2d307e39c794b10151b1caa8712f0c1cac12741d34e17fe8d2abf3706f0250e29b1f5f299cd59d3e64cb927ae534fffb508
-
C:\Users\Admin\AppData\Roaming\gfvcsvtFilesize
198KB
MD5a2f48d20a213b968e82201ef20621f38
SHA1c7578d5922e1b91259191fd64bc20bb8c7f4efff
SHA25666d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00
SHA5127c4eca440559be3fb48778b1ad9a22ab9cb78c4ac509d4b09e03bcff8fd695e2a01edfc1942a9637d10b26c5ede60327cee385a969f0af093ea9861d4ba23fcf
-
C:\Users\Admin\AppData\Roaming\gfvcsvtFilesize
198KB
MD5a2f48d20a213b968e82201ef20621f38
SHA1c7578d5922e1b91259191fd64bc20bb8c7f4efff
SHA25666d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00
SHA5127c4eca440559be3fb48778b1ad9a22ab9cb78c4ac509d4b09e03bcff8fd695e2a01edfc1942a9637d10b26c5ede60327cee385a969f0af093ea9861d4ba23fcf
-
memory/1328-246-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/1328-245-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/1328-244-0x00000000005E0000-0x000000000072A000-memory.dmpFilesize
1.3MB
-
memory/1328-243-0x00000000005E0000-0x000000000072A000-memory.dmpFilesize
1.3MB
-
memory/1568-182-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-185-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-260-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1568-248-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1568-206-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1568-205-0x0000000002560000-0x000000000283B000-memory.dmpFilesize
2.9MB
-
memory/1568-204-0x0000000002430000-0x0000000002557000-memory.dmpFilesize
1.2MB
-
memory/1568-166-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-190-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-189-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-186-0x0000000002560000-0x000000000283B000-memory.dmpFilesize
2.9MB
-
memory/1568-163-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-188-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-187-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-183-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-184-0x0000000002430000-0x0000000002557000-memory.dmpFilesize
1.2MB
-
memory/1568-181-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-180-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-179-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-178-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-177-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-176-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-175-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-173-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-172-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-171-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-170-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-168-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-169-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-159-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-156-0x0000000000000000-mapping.dmp
-
memory/1568-200-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1568-158-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-167-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-160-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-161-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-162-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/1568-164-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-153-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-151-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-155-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/3540-137-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-154-0x0000000000886000-0x0000000000897000-memory.dmpFilesize
68KB
-
memory/3540-138-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-127-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-126-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-150-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-149-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-148-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-140-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-146-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-145-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-144-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/3540-143-0x00000000006F0000-0x00000000006F9000-memory.dmpFilesize
36KB
-
memory/3540-141-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-118-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-142-0x0000000000886000-0x0000000000897000-memory.dmpFilesize
68KB
-
memory/3540-147-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-125-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-139-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-152-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-136-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-135-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-134-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-128-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-129-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-119-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-133-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-131-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-132-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-130-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-124-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-123-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-122-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-121-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/3540-120-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/4320-193-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/4320-192-0x0000000077550000-0x00000000776DE000-memory.dmpFilesize
1.6MB
-
memory/4320-191-0x0000000000000000-mapping.dmp