Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
29/09/2022, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target file.exe
- Size 271KB
- Sample220929-c61s8aheh2
- SHA256 59e63158eab6fadd44f5713e9b32548c0ebab2f71a7c45d0d15bcc7bfe180113
- MD5 f94472ebc25195311d7938126e07358c
- SHA1 c4ec1d26a42bc4d7ae68c1a63add59f3bea1b728
- SHA512 156abbe3a44bad8fade90fb6a7981df8f9b2a685c15d496a54bad37635c41a6acbc312856e8d8399b24ef7f3505e6194042704137ff686eee55fc120cc64046d
- SSDEEP 6144:vYTo2JzQFEHHwHtSYU6rL+ilIFiga3wVfg:v1F2HySYU61qIp
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
danabot
C2
-
198.15.112.179:443
-
185.62.56.245:443
-
153.92.223.225:443
-
192.119.70.159:443
Attributes
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/5028-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 2 IoCs
flow pid Process 118 984 rundll32.exe 128 984 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 4064 24ED.exe 2452 4920.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3340 4064 WerFault.exe 95 - Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5028 file.exe 5028 file.exe 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2736 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5028 file.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 2604 svchost.exe Token: SeShutdownPrivilege 2604 svchost.exe Token: SeCreatePagefilePrivilege 2604 svchost.exe Token: SeDebugPrivilege 2452 4920.exe Token: SeShutdownPrivilege 2736 Process not Found Token: SeCreatePagefilePrivilege 2736 Process not Found - Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2736 wrote to memory of 4064 2736 Process not Found 95 PID 2736 wrote to memory of 4064 2736 Process not Found 95 PID 2736 wrote to memory of 4064 2736 Process not Found 95 PID 4064 wrote to memory of 2276 4064 24ED.exe 97 PID 4064 wrote to memory of 2276 4064 24ED.exe 97 PID 4064 wrote to memory of 2276 4064 24ED.exe 97 PID 2736 wrote to memory of 2452 2736 Process not Found 100 PID 2736 wrote to memory of 2452 2736 Process not Found 100 PID 2736 wrote to memory of 2452 2736 Process not Found 100 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104 PID 4064 wrote to memory of 984 4064 24ED.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5028
-
C:\Users\Admin\AppData\Local\Temp\24ED.exeC:\Users\Admin\AppData\Local\Temp\24ED.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵PID:2276
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 6202⤵
- Program crash
PID:3340
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x31c 0x49c1⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\4920.exeC:\Users\Admin\AppData\Local\Temp\4920.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4064 -ip 40641⤵PID:1112
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\24ED.exe
- Size 1.4MB
- SHA256 ebd244f1f62b6daf6caea3eeb242a9320a61f77e4e27b830ebcd72fd2cbe047a
- MD5 91fb1cec6f44ca7e2d8d65c4e67dc6bf
- SHA1 42ef9bff684d48619b643b5a06a21c2dfd2ac2de
- SHA512 c58b454751db43d25e93f03549d8cfd7e360750337f0848661ef586fbaea681c74acf947a10f213c245cdb3fed26dbe4fe11883d30ffc820c7970bf56060b70f
- SSDEEP 24576:RlZudYgKGlzUOQradnn9hABjma9O0YAHWA1lk57JrqdKEr1C3VX7oXHx2RCahjX:RvLsNg6TABPHW8kl5bEUiXHqCK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\24ED.exe
- Size 1.4MB
- SHA256 ebd244f1f62b6daf6caea3eeb242a9320a61f77e4e27b830ebcd72fd2cbe047a
- MD5 91fb1cec6f44ca7e2d8d65c4e67dc6bf
- SHA1 42ef9bff684d48619b643b5a06a21c2dfd2ac2de
- SHA512 c58b454751db43d25e93f03549d8cfd7e360750337f0848661ef586fbaea681c74acf947a10f213c245cdb3fed26dbe4fe11883d30ffc820c7970bf56060b70f
- SSDEEP 24576:RlZudYgKGlzUOQradnn9hABjma9O0YAHWA1lk57JrqdKEr1C3VX7oXHx2RCahjX:RvLsNg6TABPHW8kl5bEUiXHqCK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\4920.exe
- Size 304KB
- SHA256 d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
- MD5 15f1517f0ceaaf9b6c78cf7625510c07
- SHA1 8aabce20aff43476586a1b69b0b761a7f39d1e7e
- SHA512 931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
- SSDEEP 3072:s33FAr6Luj5LZMI6kabxoTi35KAIHO7R6x8kwc4I7PuOnnox1U5hVkOKeS9IsmoJ:CpYakQxyHOViD7GOnnWMhVkleXxLbR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\4920.exe
- Size 304KB
- SHA256 d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
- MD5 15f1517f0ceaaf9b6c78cf7625510c07
- SHA1 8aabce20aff43476586a1b69b0b761a7f39d1e7e
- SHA512 931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
- SSDEEP 3072:s33FAr6Luj5LZMI6kabxoTi35KAIHO7R6x8kwc4I7PuOnnox1U5hVkOKeS9IsmoJ:CpYakQxyHOViD7GOnnWMhVkleXxLbR
- MD5 SHA1 SHA512 SSDEEP