Analysis
-
max time kernel
152s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
24-09-2022 18:07
Static task
static1
Behavioral task
behavioral1
Sample
19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exe
Resource
win10-20220812-en
General
-
Target
19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exe
-
Size
197KB
-
MD5
58f02242f64d9710d78288ab73465a6f
-
SHA1
eab3d8b9986206819c80b40aef7b15a46e1781fd
-
SHA256
19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c
-
SHA512
e54af000eb4dca04e12e75e3aa1dc9edf50da168713e056038b1fac12e234666802b71ddb3dbd28ddeb62182f933c74638a1222ff3c29789da993be639a7afff
-
SSDEEP
3072:vAIsMEcLfZ4UFrBA5ul+OOtte1hekcdbxe2nSflehKBQ0ZT/Pkk4x:LrLflFrroOiteuxtSflgzw
Malware Config
Extracted
danabot
198.15.112.179:443
185.62.56.245:443
153.92.223.225:443
192.119.70.159:443
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1888-146-0x00000000006B0000-0x00000000006B9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
5870.exejgeaudjpid process 1884 5870.exe 4720 jgeaudj -
Deletes itself 1 IoCs
Processes:
pid process 3024 -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4748 1884 WerFault.exe 5870.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
jgeaudj19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jgeaudj Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jgeaudj Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jgeaudj -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exepid process 1888 19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exe 1888 19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exe 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3024 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exejgeaudjpid process 1888 19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exe 4720 jgeaudj -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3024 Token: SeCreatePagefilePrivilege 3024 Token: SeShutdownPrivilege 3024 Token: SeCreatePagefilePrivilege 3024 Token: SeShutdownPrivilege 3024 Token: SeCreatePagefilePrivilege 3024 Token: SeShutdownPrivilege 3024 Token: SeCreatePagefilePrivilege 3024 -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5870.exedescription pid process target process PID 3024 wrote to memory of 1884 3024 5870.exe PID 3024 wrote to memory of 1884 3024 5870.exe PID 3024 wrote to memory of 1884 3024 5870.exe PID 1884 wrote to memory of 5064 1884 5870.exe appidtel.exe PID 1884 wrote to memory of 5064 1884 5870.exe appidtel.exe PID 1884 wrote to memory of 5064 1884 5870.exe appidtel.exe PID 1884 wrote to memory of 3340 1884 5870.exe rundll32.exe PID 1884 wrote to memory of 3340 1884 5870.exe rundll32.exe PID 1884 wrote to memory of 3340 1884 5870.exe rundll32.exe PID 1884 wrote to memory of 3340 1884 5870.exe rundll32.exe PID 1884 wrote to memory of 3340 1884 5870.exe rundll32.exe PID 1884 wrote to memory of 3340 1884 5870.exe rundll32.exe PID 1884 wrote to memory of 3340 1884 5870.exe rundll32.exe PID 1884 wrote to memory of 3340 1884 5870.exe rundll32.exe PID 1884 wrote to memory of 3340 1884 5870.exe rundll32.exe PID 1884 wrote to memory of 3340 1884 5870.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exe"C:\Users\Admin\AppData\Local\Temp\19cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5870.exeC:\Users\Admin\AppData\Local\Temp\5870.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 5682⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\jgeaudjC:\Users\Admin\AppData\Roaming\jgeaudj1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5870.exeFilesize
1.3MB
MD58be973f2c40d65cee775031acfce4c95
SHA1b0842d327fbcc455d31d18e68c650605dffd79fe
SHA256e2fcefc8cb739c0e8da7e3c605ccd851b6d958dadc47be23e08aa3b35992632e
SHA5129aac64f997ce000a0000596443d199e1a1bcb7bc2a6397e25cd3ea4dfecae79534c62e6966440f10993441e2aaeda7c9be677081ad22c67a15ec297ad5cdd0a7
-
C:\Users\Admin\AppData\Local\Temp\5870.exeFilesize
1.3MB
MD58be973f2c40d65cee775031acfce4c95
SHA1b0842d327fbcc455d31d18e68c650605dffd79fe
SHA256e2fcefc8cb739c0e8da7e3c605ccd851b6d958dadc47be23e08aa3b35992632e
SHA5129aac64f997ce000a0000596443d199e1a1bcb7bc2a6397e25cd3ea4dfecae79534c62e6966440f10993441e2aaeda7c9be677081ad22c67a15ec297ad5cdd0a7
-
C:\Users\Admin\AppData\Roaming\jgeaudjFilesize
197KB
MD558f02242f64d9710d78288ab73465a6f
SHA1eab3d8b9986206819c80b40aef7b15a46e1781fd
SHA25619cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c
SHA512e54af000eb4dca04e12e75e3aa1dc9edf50da168713e056038b1fac12e234666802b71ddb3dbd28ddeb62182f933c74638a1222ff3c29789da993be639a7afff
-
C:\Users\Admin\AppData\Roaming\jgeaudjFilesize
197KB
MD558f02242f64d9710d78288ab73465a6f
SHA1eab3d8b9986206819c80b40aef7b15a46e1781fd
SHA25619cc2cdc70b17dc119f3447ddba84680b19ba6566a3fc39fa54c6251bb19623c
SHA512e54af000eb4dca04e12e75e3aa1dc9edf50da168713e056038b1fac12e234666802b71ddb3dbd28ddeb62182f933c74638a1222ff3c29789da993be639a7afff
-
memory/1884-186-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-163-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-168-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-222-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1884-165-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-210-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1884-208-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1884-207-0x0000000002530000-0x000000000280B000-memory.dmpFilesize
2.9MB
-
memory/1884-206-0x0000000002400000-0x0000000002528000-memory.dmpFilesize
1.2MB
-
memory/1884-193-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1884-192-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-191-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-190-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-189-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-188-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-187-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-184-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-185-0x0000000002530000-0x000000000280B000-memory.dmpFilesize
2.9MB
-
memory/1884-182-0x0000000002400000-0x0000000002528000-memory.dmpFilesize
1.2MB
-
memory/1884-183-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-181-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-180-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-179-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-178-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-177-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-174-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-175-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-173-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-172-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-171-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-170-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-166-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-169-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-164-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-158-0x0000000000000000-mapping.dmp
-
memory/1884-161-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-160-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1884-162-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-146-0x00000000006B0000-0x00000000006B9000-memory.dmpFilesize
36KB
-
memory/1888-120-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-128-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-156-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-122-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-123-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-157-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/1888-155-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-154-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-153-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-152-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-151-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-150-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-149-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-148-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/1888-147-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-125-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-145-0x00000000006D0000-0x000000000081A000-memory.dmpFilesize
1.3MB
-
memory/1888-144-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-143-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-142-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-124-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-141-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-140-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-139-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-138-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-137-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-136-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-134-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-133-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-121-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-126-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-127-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-132-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-131-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-130-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/1888-129-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/4720-256-0x0000000000916000-0x0000000000927000-memory.dmpFilesize
68KB
-
memory/4720-259-0x0000000000590000-0x00000000006DA000-memory.dmpFilesize
1.3MB
-
memory/4720-260-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/4720-261-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/5064-196-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/5064-195-0x0000000077CB0000-0x0000000077E3E000-memory.dmpFilesize
1.6MB
-
memory/5064-194-0x0000000000000000-mapping.dmp