Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
28/09/2022, 14:19
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target file.exe
- Size 294KB
- Sample220928-rmtywsgbb3
- SHA256 a6944f5e05e82adbaa5a356d3c68d1220c5c5eafa59e63fb74a1ffd01fffb9cf
- MD5 b08113b4900c0dd2b07f6bcd0aaeac51
- SHA1 021b2cc5d7f0b1287e432a0a8e4ee5718f87b25e
- SHA512 46616aa81189aaa63f34db097cec53dcf09aad8490e35cddf877ec86aff710d2b0cb1db3ed0742bab0a0f77e546d715268420953f31000c851933f5930d5cc1b
- SSDEEP 6144:FaO7eL5iJLhraid4EVNjk0cClvJGJigavwVfIx:FCMJZaM1LbRx
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
danabot
C2
-
198.15.112.179:443
-
185.62.56.245:443
-
153.92.223.225:443
-
192.119.70.159:443
Attributes
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/1756-133-0x0000000000520000-0x0000000000529000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 2 IoCs
flow pid Process 89 4944 rundll32.exe 98 4944 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
pid Process 2040 1ADB.exe 3168 sriacsr 4288 904A.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3160 2040 WerFault.exe 88 - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sriacsr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sriacsr Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sriacsr - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1756 file.exe 1756 file.exe 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2456 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1756 file.exe 3168 sriacsr - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 332 svchost.exe Token: SeShutdownPrivilege 332 svchost.exe Token: SeCreatePagefilePrivilege 332 svchost.exe Token: SeDebugPrivilege 4288 904A.exe Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2040 2456 Process not Found 88 PID 2456 wrote to memory of 2040 2456 Process not Found 88 PID 2456 wrote to memory of 2040 2456 Process not Found 88 PID 2040 wrote to memory of 4252 2040 1ADB.exe 89 PID 2040 wrote to memory of 4252 2040 1ADB.exe 89 PID 2040 wrote to memory of 4252 2040 1ADB.exe 89 PID 2456 wrote to memory of 4288 2456 Process not Found 94 PID 2456 wrote to memory of 4288 2456 Process not Found 94 PID 2456 wrote to memory of 4288 2456 Process not Found 94 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96 PID 2040 wrote to memory of 4944 2040 1ADB.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1756
-
C:\Users\Admin\AppData\Local\Temp\1ADB.exeC:\Users\Admin\AppData\Local\Temp\1ADB.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵PID:4252
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:4944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 6202⤵
- Program crash
PID:3160
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:332
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x394 0x4f81⤵PID:2136
-
C:\Users\Admin\AppData\Roaming\sriacsrC:\Users\Admin\AppData\Roaming\sriacsr1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3168
-
C:\Users\Admin\AppData\Local\Temp\904A.exeC:\Users\Admin\AppData\Local\Temp\904A.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2040 -ip 20401⤵PID:4032
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\1ADB.exe
- Size 1.4MB
- SHA256 6e7bd8911ab83364178e8e18ba05f35c78469b7d8ca12fbc06695cd39fb8c0b5
- MD5 db7b9097515bdd31c0b02533d75c676d
- SHA1 7dace67c913abfef16b613c072010ecc8cb56021
- SHA512 4630c0ddb7747ae25dddc6bccb0cb6b3859f6894ec6648105e0e0f7f058acf77466a7db9759d3ed13548af0da6c53ae8c9caa9eb91cfb32e4e50e919baa5d8b6
- SSDEEP 24576:KCnWoU0I5kxIGdU9P8aCw3RUzyuB2WcdeA3/iB9FobICvozjNHMy029O9VFkbxX:KZtp7z1Mzf2WcUbBH++5f0F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1ADB.exe
- Size 1.4MB
- SHA256 6e7bd8911ab83364178e8e18ba05f35c78469b7d8ca12fbc06695cd39fb8c0b5
- MD5 db7b9097515bdd31c0b02533d75c676d
- SHA1 7dace67c913abfef16b613c072010ecc8cb56021
- SHA512 4630c0ddb7747ae25dddc6bccb0cb6b3859f6894ec6648105e0e0f7f058acf77466a7db9759d3ed13548af0da6c53ae8c9caa9eb91cfb32e4e50e919baa5d8b6
- SSDEEP 24576:KCnWoU0I5kxIGdU9P8aCw3RUzyuB2WcdeA3/iB9FobICvozjNHMy029O9VFkbxX:KZtp7z1Mzf2WcUbBH++5f0F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\904A.exe
- Size 304KB
- SHA256 d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
- MD5 15f1517f0ceaaf9b6c78cf7625510c07
- SHA1 8aabce20aff43476586a1b69b0b761a7f39d1e7e
- SHA512 931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
- SSDEEP 3072:s33FAr6Luj5LZMI6kabxoTi35KAIHO7R6x8kwc4I7PuOnnox1U5hVkOKeS9IsmoJ:CpYakQxyHOViD7GOnnWMhVkleXxLbR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\904A.exe
- Size 304KB
- SHA256 d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
- MD5 15f1517f0ceaaf9b6c78cf7625510c07
- SHA1 8aabce20aff43476586a1b69b0b761a7f39d1e7e
- SHA512 931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
- SSDEEP 3072:s33FAr6Luj5LZMI6kabxoTi35KAIHO7R6x8kwc4I7PuOnnox1U5hVkOKeS9IsmoJ:CpYakQxyHOViD7GOnnWMhVkleXxLbR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\sriacsr
- Size 294KB
- SHA256 a6944f5e05e82adbaa5a356d3c68d1220c5c5eafa59e63fb74a1ffd01fffb9cf
- MD5 b08113b4900c0dd2b07f6bcd0aaeac51
- SHA1 021b2cc5d7f0b1287e432a0a8e4ee5718f87b25e
- SHA512 46616aa81189aaa63f34db097cec53dcf09aad8490e35cddf877ec86aff710d2b0cb1db3ed0742bab0a0f77e546d715268420953f31000c851933f5930d5cc1b
- SSDEEP 6144:FaO7eL5iJLhraid4EVNjk0cClvJGJigavwVfIx:FCMJZaM1LbRx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\sriacsr
- Size 294KB
- SHA256 a6944f5e05e82adbaa5a356d3c68d1220c5c5eafa59e63fb74a1ffd01fffb9cf
- MD5 b08113b4900c0dd2b07f6bcd0aaeac51
- SHA1 021b2cc5d7f0b1287e432a0a8e4ee5718f87b25e
- SHA512 46616aa81189aaa63f34db097cec53dcf09aad8490e35cddf877ec86aff710d2b0cb1db3ed0742bab0a0f77e546d715268420953f31000c851933f5930d5cc1b
- SSDEEP 6144:FaO7eL5iJLhraid4EVNjk0cClvJGJigavwVfIx:FCMJZaM1LbRx
- MD5 SHA1 SHA512 SSDEEP