Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2022 20:52
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
file.exe
-
Size
270KB
-
MD5
8e585d7c9fcc8aef9ab94febdc17de82
-
SHA1
df345a065922b89243780b45d5fd8769a7e7b24c
-
SHA256
a6650e8e5968e516505133725bc634c8d524c925bed6de04b068f0f25d469d2b
-
SHA512
060a11693aa56a03ccc71a54b246264e87c5ce207cbd2dd75fc0e4667f238fa4a9ac163f59b9f7060e0a26b65a8bea81325f48f42785f480ac76b034c5d03f07
-
SSDEEP
3072:EXhklC/qA0TAJ5MD4/Mb5pBMEcTTvrZakX+cePKOG7xysxkgaBChUpZa9uD6VdyE:A+l3cJ5S46YTQk7eKxviga3wVfg
Score
10/10
Malware Config
Extracted
Family
danabot
C2
198.15.112.179:443
185.62.56.245:443
153.92.223.225:443
192.119.70.159:443
Attributes
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4800-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 2 IoCs
flow pid Process 102 4496 rundll32.exe 111 4496 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 3288 151E.exe 3660 86E4.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2720 3288 WerFault.exe 90 -
Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4800 file.exe 4800 file.exe 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found 2212 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2212 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4800 file.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 996 svchost.exe Token: SeShutdownPrivilege 996 svchost.exe Token: SeCreatePagefilePrivilege 996 svchost.exe Token: SeDebugPrivilege 3660 86E4.exe Token: SeShutdownPrivilege 2212 Process not Found Token: SeCreatePagefilePrivilege 2212 Process not Found -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 2212 wrote to memory of 3288 2212 Process not Found 90 PID 2212 wrote to memory of 3288 2212 Process not Found 90 PID 2212 wrote to memory of 3288 2212 Process not Found 90 PID 3288 wrote to memory of 2504 3288 151E.exe 91 PID 3288 wrote to memory of 2504 3288 151E.exe 91 PID 3288 wrote to memory of 2504 3288 151E.exe 91 PID 2212 wrote to memory of 3660 2212 Process not Found 95 PID 2212 wrote to memory of 3660 2212 Process not Found 95 PID 2212 wrote to memory of 3660 2212 Process not Found 95 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98 PID 3288 wrote to memory of 4496 3288 151E.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4800
-
C:\Users\Admin\AppData\Local\Temp\151E.exeC:\Users\Admin\AppData\Local\Temp\151E.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵PID:2504
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:4496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 6202⤵
- Program crash
PID:2720
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:996
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a8 0x4ac1⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\86E4.exeC:\Users\Admin\AppData\Local\Temp\86E4.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3288 -ip 32881⤵PID:1852
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5f403f225202172f1503d4976f6570d3b
SHA117e90a26988904252e4dffbb5b0a843ef2fc4022
SHA25674ba5191b358bca3cf41a77e2315dbb7d5be92623de497b5b50d0c5edd3fdad7
SHA512b6a0532b2c9e46562d43da470bc7649147dcf73dd9ee2a9b9e00ff3e1208c494bfc5bda47d2bede77d52aee01f26c40db60ad25f2be44f0286be7cc6bebf036f
-
Filesize
1.4MB
MD5f403f225202172f1503d4976f6570d3b
SHA117e90a26988904252e4dffbb5b0a843ef2fc4022
SHA25674ba5191b358bca3cf41a77e2315dbb7d5be92623de497b5b50d0c5edd3fdad7
SHA512b6a0532b2c9e46562d43da470bc7649147dcf73dd9ee2a9b9e00ff3e1208c494bfc5bda47d2bede77d52aee01f26c40db60ad25f2be44f0286be7cc6bebf036f
-
Filesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
Filesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516