Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2022 00:09
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
129KB
-
MD5
56baf889e727b4f3f6c8b046c0d9d2ff
-
SHA1
09923bf99249d962e0546deedc210530ab359da6
-
SHA256
5dcffd6a989fbd0402981422bc7c0201d769d999ae58d6862672eccbfc160aed
-
SHA512
8f6c062c0754b220bd97c8f96aea157f9017264d7ea6c486e45ad24c9bc8ae95a4544a168456a26506b7fb5c5dfc22a40e3dc724ecfcecdb2d5395330fdc3cbd
-
SSDEEP
3072:eSWHsTI5q/cNeenWb4mygrrE2KrTsAOJeqnTGtWzwI45B:ehyiiLZj8iJtnTnz
Malware Config
Extracted
danabot
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2564-133-0x0000000000710000-0x0000000000719000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
F811.exebtbwjef7FC0.exepid process 1192 F811.exe 2336 btbwjef 3432 7FC0.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1780 1192 WerFault.exe F811.exe -
Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exebtbwjeffile.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI btbwjef Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI btbwjef Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI btbwjef Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 2564 file.exe 2564 file.exe 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 2376 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2376 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
file.exebtbwjefpid process 2564 file.exe 2336 btbwjef -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exe7FC0.exedescription pid process Token: SeShutdownPrivilege 1908 svchost.exe Token: SeShutdownPrivilege 1908 svchost.exe Token: SeCreatePagefilePrivilege 1908 svchost.exe Token: SeDebugPrivilege 3432 7FC0.exe Token: SeShutdownPrivilege 2376 Token: SeCreatePagefilePrivilege 2376 -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
F811.exedescription pid process target process PID 2376 wrote to memory of 1192 2376 F811.exe PID 2376 wrote to memory of 1192 2376 F811.exe PID 2376 wrote to memory of 1192 2376 F811.exe PID 1192 wrote to memory of 2292 1192 F811.exe agentactivationruntimestarter.exe PID 1192 wrote to memory of 2292 1192 F811.exe agentactivationruntimestarter.exe PID 1192 wrote to memory of 2292 1192 F811.exe agentactivationruntimestarter.exe PID 2376 wrote to memory of 3432 2376 7FC0.exe PID 2376 wrote to memory of 3432 2376 7FC0.exe PID 2376 wrote to memory of 3432 2376 7FC0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F811.exeC:\Users\Admin\AppData\Local\Temp\F811.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 4282⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f8 0x3bc1⤵
-
C:\Users\Admin\AppData\Roaming\btbwjefC:\Users\Admin\AppData\Roaming\btbwjef1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7FC0.exeC:\Users\Admin\AppData\Local\Temp\7FC0.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1192 -ip 11921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7FC0.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
C:\Users\Admin\AppData\Local\Temp\7FC0.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
C:\Users\Admin\AppData\Local\Temp\F811.exeFilesize
1.2MB
MD5b36c6847d5869ecec3b972acd92bb012
SHA1b75b3d199370606558f54d7128f8997f05eb8ea1
SHA2562273c16e6bf0e6149472869ad7edb62c61501e1d34be52c57e9f473f2fb26d7a
SHA51225dce16692bc3404647bdaf261188e420c24f8e7d472761b60b877aa60d316cefdcfbb501487bafa54b685029ba30354ec272c9285740883110b8ad3991bcfb7
-
C:\Users\Admin\AppData\Local\Temp\F811.exeFilesize
1.2MB
MD5b36c6847d5869ecec3b972acd92bb012
SHA1b75b3d199370606558f54d7128f8997f05eb8ea1
SHA2562273c16e6bf0e6149472869ad7edb62c61501e1d34be52c57e9f473f2fb26d7a
SHA51225dce16692bc3404647bdaf261188e420c24f8e7d472761b60b877aa60d316cefdcfbb501487bafa54b685029ba30354ec272c9285740883110b8ad3991bcfb7
-
C:\Users\Admin\AppData\Roaming\btbwjefFilesize
129KB
MD556baf889e727b4f3f6c8b046c0d9d2ff
SHA109923bf99249d962e0546deedc210530ab359da6
SHA2565dcffd6a989fbd0402981422bc7c0201d769d999ae58d6862672eccbfc160aed
SHA5128f6c062c0754b220bd97c8f96aea157f9017264d7ea6c486e45ad24c9bc8ae95a4544a168456a26506b7fb5c5dfc22a40e3dc724ecfcecdb2d5395330fdc3cbd
-
C:\Users\Admin\AppData\Roaming\btbwjefFilesize
129KB
MD556baf889e727b4f3f6c8b046c0d9d2ff
SHA109923bf99249d962e0546deedc210530ab359da6
SHA2565dcffd6a989fbd0402981422bc7c0201d769d999ae58d6862672eccbfc160aed
SHA5128f6c062c0754b220bd97c8f96aea157f9017264d7ea6c486e45ad24c9bc8ae95a4544a168456a26506b7fb5c5dfc22a40e3dc724ecfcecdb2d5395330fdc3cbd
-
memory/1192-161-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1192-140-0x0000000002351000-0x0000000002477000-memory.dmpFilesize
1.1MB
-
memory/1192-141-0x0000000002480000-0x000000000275B000-memory.dmpFilesize
2.9MB
-
memory/1192-142-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1192-143-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1192-136-0x0000000000000000-mapping.dmp
-
memory/1192-162-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1192-163-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/2292-139-0x0000000000000000-mapping.dmp
-
memory/2336-148-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/2336-147-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/2336-146-0x0000000000848000-0x0000000000859000-memory.dmpFilesize
68KB
-
memory/2564-132-0x0000000000789000-0x000000000079A000-memory.dmpFilesize
68KB
-
memory/2564-133-0x0000000000710000-0x0000000000719000-memory.dmpFilesize
36KB
-
memory/2564-134-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/2564-135-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/3432-156-0x00000000052B0000-0x00000000058C8000-memory.dmpFilesize
6.1MB
-
memory/3432-155-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB
-
memory/3432-154-0x0000000002210000-0x0000000002247000-memory.dmpFilesize
220KB
-
memory/3432-157-0x0000000005940000-0x0000000005952000-memory.dmpFilesize
72KB
-
memory/3432-158-0x0000000005960000-0x0000000005A6A000-memory.dmpFilesize
1.0MB
-
memory/3432-159-0x0000000005A90000-0x0000000005ACC000-memory.dmpFilesize
240KB
-
memory/3432-160-0x00000000005F9000-0x0000000000623000-memory.dmpFilesize
168KB
-
memory/3432-153-0x00000000005F9000-0x0000000000623000-memory.dmpFilesize
168KB
-
memory/3432-152-0x0000000004D00000-0x00000000052A4000-memory.dmpFilesize
5.6MB
-
memory/3432-149-0x0000000000000000-mapping.dmp