Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
27/09/2022, 13:12
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
- Target file.exe
- Size 318KB
- Sample220927-qfhfvaefcr
- SHA256 050c4da21014e862e6e72e478aa6e070882aadf92d9c44ae27a9f6be5d65c8a1
- MD5 d06e08241c9b350223d92855f21e42e5
- SHA1 a466b9e19364efe73168dfb7fd911d83e3e165e2
- SHA512 e90b99dc79f652d9ecf569aa8b366b651bb8c4cf744e94cec74cae17d6dd9aca9d58508a470c5eb66535ae355874acd36e192165a0e806c638403d4c2b410647
- SSDEEP 3072:2FfX1BP90fWdWWDYq25SA1Hxuk+QK/+iIEWU0KY8gnVM/h3BsxkgaBChU/pZa9uR:2FPbuq8nRRK/+iI7U0zbVnigabwVf
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
danabot
C2
-
198.15.112.179:443
-
185.62.56.245:443
-
153.92.223.225:443
-
192.119.70.159:443
Attributes
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4776-133-0x0000000000500000-0x0000000000509000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
flow pid Process 86 3532 rundll32.exe 87 3532 rundll32.exe 88 3532 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 3672 EBDC.exe 4056 86D.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 2 IoCs
pid pid_target Process procid_target 3748 4056 WerFault.exe 95 1520 3672 WerFault.exe 90 - Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4776 file.exe 4776 file.exe 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2212 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4776 file.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 3020 svchost.exe Token: SeShutdownPrivilege 3020 svchost.exe Token: SeCreatePagefilePrivilege 3020 svchost.exe Token: SeDebugPrivilege 4056 86D.exe Token: SeShutdownPrivilege 2212 Process not Found Token: SeCreatePagefilePrivilege 2212 Process not Found Token: SeShutdownPrivilege 2212 Process not Found Token: SeCreatePagefilePrivilege 2212 Process not Found Token: SeShutdownPrivilege 2212 Process not Found Token: SeCreatePagefilePrivilege 2212 Process not Found - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2212 wrote to memory of 3672 2212 Process not Found 90 PID 2212 wrote to memory of 3672 2212 Process not Found 90 PID 2212 wrote to memory of 3672 2212 Process not Found 90 PID 3672 wrote to memory of 4956 3672 EBDC.exe 91 PID 3672 wrote to memory of 4956 3672 EBDC.exe 91 PID 3672 wrote to memory of 4956 3672 EBDC.exe 91 PID 2212 wrote to memory of 4056 2212 Process not Found 95 PID 2212 wrote to memory of 4056 2212 Process not Found 95 PID 2212 wrote to memory of 4056 2212 Process not Found 95 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99 PID 3672 wrote to memory of 3532 3672 EBDC.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4776
-
C:\Users\Admin\AppData\Local\Temp\EBDC.exeC:\Users\Admin\AppData\Local\Temp\EBDC.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵PID:4956
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:3532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 6402⤵
- Program crash
PID:1520
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x500 0x2b41⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\86D.exeC:\Users\Admin\AppData\Local\Temp\86D.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 13162⤵
- Program crash
PID:3748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4056 -ip 40561⤵PID:2064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3672 -ip 36721⤵PID:4088
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\86D.exe
- Size 304KB
- SHA256 d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
- MD5 15f1517f0ceaaf9b6c78cf7625510c07
- SHA1 8aabce20aff43476586a1b69b0b761a7f39d1e7e
- SHA512 931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
- SSDEEP 3072:s33FAr6Luj5LZMI6kabxoTi35KAIHO7R6x8kwc4I7PuOnnox1U5hVkOKeS9IsmoJ:CpYakQxyHOViD7GOnnWMhVkleXxLbR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\86D.exe
- Size 304KB
- SHA256 d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
- MD5 15f1517f0ceaaf9b6c78cf7625510c07
- SHA1 8aabce20aff43476586a1b69b0b761a7f39d1e7e
- SHA512 931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
- SSDEEP 3072:s33FAr6Luj5LZMI6kabxoTi35KAIHO7R6x8kwc4I7PuOnnox1U5hVkOKeS9IsmoJ:CpYakQxyHOViD7GOnnWMhVkleXxLbR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EBDC.exe
- Size 1.4MB
- SHA256 287a450c85acd94eb44313b69ee9f2926cfeb3359251efbface372e8e60e0748
- MD5 a59ef7b3cc1f268b5b690d1adb70eaea
- SHA1 5e23e9da8be9808620ed16bc139dae0d90219c70
- SHA512 84e58d976758629cac4bad8c8ed457f91b937ed8df6115bc187a1926107603d7ea45c58bde17808c4075020ec3762db95f4957c16a05dc1b1c4585a1e91c37e8
- SSDEEP 24576:37TPLeD9dEc7QE0hhwC8PAtpcWpas53zX63WGIu/w6sP0fm2LzDEbPD/hA9fCCzD:rTPCD9K5hgAXcWpJzXvLb6O0rr8hA9fP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EBDC.exe
- Size 1.4MB
- SHA256 287a450c85acd94eb44313b69ee9f2926cfeb3359251efbface372e8e60e0748
- MD5 a59ef7b3cc1f268b5b690d1adb70eaea
- SHA1 5e23e9da8be9808620ed16bc139dae0d90219c70
- SHA512 84e58d976758629cac4bad8c8ed457f91b937ed8df6115bc187a1926107603d7ea45c58bde17808c4075020ec3762db95f4957c16a05dc1b1c4585a1e91c37e8
- SSDEEP 24576:37TPLeD9dEc7QE0hhwC8PAtpcWpas53zX63WGIu/w6sP0fm2LzDEbPD/hA9fCCzD:rTPCD9K5hgAXcWpJzXvLb6O0rr8hA9fP
- MD5 SHA1 SHA512 SSDEEP