Analysis
- max time kernel
155s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
02/10/2022, 18:38
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 133KB
- Sample221002-w92pgafdg6
- SHA256 73ea8bc1ce6d229ceb703c4f756bb61fb8268ff0e0929bda62b2eefde62719d5
- MD5 6396bdcdcc0b0c3f24e19a16fa16d617
- SHA1 aa3a5c6764efdf09b640470a959e0a8bb63adee9
- SHA512 24a171357e311aa490ebf1b0ee2b3d534fd0c50680e4574ed133acdf87eb1cdb2f0f52241bd98b6012b63ab3aa556605226f522bd91c5049e7c14e631a602e42
- SSDEEP 3072:nf3S5ORlIySUJwrhqeZ17QXpT+zVb6VFrZzfG:a2IySPweZMpTw6Vbzf
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
danabot
Attributes
-
embedded_hash
F11D3871631E16E8DE15C24B32328D98
-
type
loader
Signatures
- Detects Smokeloader packer 2 IoCs
resource yara_rule behavioral2/memory/1256-133-0x00000000006D0000-0x00000000006D9000-memory.dmp family_smokeloader behavioral2/memory/1256-136-0x00000000006D0000-0x00000000006D9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 1720 hcbjwet 4888 9C7A.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hcbjwet Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hcbjwet Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hcbjwet Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1256 file.exe 1256 file.exe 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found 2432 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2432 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1256 file.exe 1720 hcbjwet - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 3044 svchost.exe Token: SeShutdownPrivilege 3044 svchost.exe Token: SeCreatePagefilePrivilege 3044 svchost.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2432 wrote to memory of 4888 2432 Process not Found 92 PID 2432 wrote to memory of 4888 2432 Process not Found 92 PID 2432 wrote to memory of 4888 2432 Process not Found 92 PID 4888 wrote to memory of 1976 4888 9C7A.exe 93 PID 4888 wrote to memory of 1976 4888 9C7A.exe 93 PID 4888 wrote to memory of 1976 4888 9C7A.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1256
-
C:\Users\Admin\AppData\Roaming\hcbjwetC:\Users\Admin\AppData\Roaming\hcbjwet1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1720
-
C:\Users\Admin\AppData\Local\Temp\9C7A.exeC:\Users\Admin\AppData\Local\Temp\9C7A.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵PID:1976
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3f8 0x3001⤵PID:3924
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\9C7A.exe
- Size 1.2MB
- SHA256 bf987b154366796ea86530591a254d7194b5ded59851bcd413c132ecbcb14dbc
- MD5 aac4cf10e75546c527780814c4e2c61b
- SHA1 5817a1e5f9f5ac7926b5d6ed4a0e618c6c02ba00
- SHA512 93a949c1f474f879496b1376cac0f80c2d769822f628caeca7e2dc419b050393242a96ed2cf3196fd6d73c5e8ca8645115f33de1a4937ee904ad18a1db5f9fde
- SSDEEP 24576:dTH6JK1FTtBHw4mEp1DouHO6c+lgFkTsF5BTAr6CJ56G9V3Gt:VHDvPdHDDC+Ad4r3OGG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\9C7A.exe
- Size 1.2MB
- SHA256 bf987b154366796ea86530591a254d7194b5ded59851bcd413c132ecbcb14dbc
- MD5 aac4cf10e75546c527780814c4e2c61b
- SHA1 5817a1e5f9f5ac7926b5d6ed4a0e618c6c02ba00
- SHA512 93a949c1f474f879496b1376cac0f80c2d769822f628caeca7e2dc419b050393242a96ed2cf3196fd6d73c5e8ca8645115f33de1a4937ee904ad18a1db5f9fde
- SSDEEP 24576:dTH6JK1FTtBHw4mEp1DouHO6c+lgFkTsF5BTAr6CJ56G9V3Gt:VHDvPdHDDC+Ad4r3OGG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\hcbjwet
- Size 133KB
- SHA256 73ea8bc1ce6d229ceb703c4f756bb61fb8268ff0e0929bda62b2eefde62719d5
- MD5 6396bdcdcc0b0c3f24e19a16fa16d617
- SHA1 aa3a5c6764efdf09b640470a959e0a8bb63adee9
- SHA512 24a171357e311aa490ebf1b0ee2b3d534fd0c50680e4574ed133acdf87eb1cdb2f0f52241bd98b6012b63ab3aa556605226f522bd91c5049e7c14e631a602e42
- SSDEEP 3072:nf3S5ORlIySUJwrhqeZ17QXpT+zVb6VFrZzfG:a2IySPweZMpTw6Vbzf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\hcbjwet
- Size 133KB
- SHA256 73ea8bc1ce6d229ceb703c4f756bb61fb8268ff0e0929bda62b2eefde62719d5
- MD5 6396bdcdcc0b0c3f24e19a16fa16d617
- SHA1 aa3a5c6764efdf09b640470a959e0a8bb63adee9
- SHA512 24a171357e311aa490ebf1b0ee2b3d534fd0c50680e4574ed133acdf87eb1cdb2f0f52241bd98b6012b63ab3aa556605226f522bd91c5049e7c14e631a602e42
- SSDEEP 3072:nf3S5ORlIySUJwrhqeZ17QXpT+zVb6VFrZzfG:a2IySPweZMpTw6Vbzf
- MD5 SHA1 SHA512 SSDEEP