Analysis
-
max time kernel
156s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 16:25
Static task
static1
Behavioral task
behavioral1
Sample
6a5cae6d9f10a5bf3bae6240be9b655c30c7ef61805efa18c46b36561284ccbd.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
6a5cae6d9f10a5bf3bae6240be9b655c30c7ef61805efa18c46b36561284ccbd.exe
-
Size
145KB
-
MD5
d02170372ec1718dd970344a82b59c68
-
SHA1
2a5848e782349bbd844fdd22c69357518e5fda36
-
SHA256
6a5cae6d9f10a5bf3bae6240be9b655c30c7ef61805efa18c46b36561284ccbd
-
SHA512
4c3395c9abdb99f57a1732c6d856e91d8c99051d9eb322228203bab9b9533c3adbfa2e041217d25382e639649bc307a3a136134bfc34c60fd1d3fe798fae133e
-
SSDEEP
3072:84i18a9a3vwVjvDFa3WSuPpaLdzamS12j+O:84n+vDFaGR4ZzpNj+
Score
10/10
Malware Config
Extracted
Family
danabot
C2
192.236.233.188:443
192.119.70.159:443
23.106.124.171:443
Attributes
-
embedded_hash
F11D3871631E16E8DE15C24B32328D98
-
type
loader
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/5012-133-0x0000000000640000-0x0000000000649000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 3532 7CA2.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1908 3532 WerFault.exe 88 -
Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6a5cae6d9f10a5bf3bae6240be9b655c30c7ef61805efa18c46b36561284ccbd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6a5cae6d9f10a5bf3bae6240be9b655c30c7ef61805efa18c46b36561284ccbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6a5cae6d9f10a5bf3bae6240be9b655c30c7ef61805efa18c46b36561284ccbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5012 6a5cae6d9f10a5bf3bae6240be9b655c30c7ef61805efa18c46b36561284ccbd.exe 5012 6a5cae6d9f10a5bf3bae6240be9b655c30c7ef61805efa18c46b36561284ccbd.exe 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found 1996 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1996 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5012 6a5cae6d9f10a5bf3bae6240be9b655c30c7ef61805efa18c46b36561284ccbd.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeShutdownPrivilege 1132 svchost.exe Token: SeShutdownPrivilege 1132 svchost.exe Token: SeCreatePagefilePrivilege 1132 svchost.exe Token: SeShutdownPrivilege 1996 Process not Found Token: SeCreatePagefilePrivilege 1996 Process not Found -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1996 wrote to memory of 3532 1996 Process not Found 88 PID 1996 wrote to memory of 3532 1996 Process not Found 88 PID 1996 wrote to memory of 3532 1996 Process not Found 88 PID 3532 wrote to memory of 4680 3532 7CA2.exe 89 PID 3532 wrote to memory of 4680 3532 7CA2.exe 89 PID 3532 wrote to memory of 4680 3532 7CA2.exe 89 PID 3532 wrote to memory of 844 3532 7CA2.exe 94 PID 3532 wrote to memory of 844 3532 7CA2.exe 94 PID 3532 wrote to memory of 844 3532 7CA2.exe 94 PID 3532 wrote to memory of 844 3532 7CA2.exe 94 PID 3532 wrote to memory of 844 3532 7CA2.exe 94 PID 3532 wrote to memory of 844 3532 7CA2.exe 94 PID 3532 wrote to memory of 844 3532 7CA2.exe 94 PID 3532 wrote to memory of 844 3532 7CA2.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a5cae6d9f10a5bf3bae6240be9b655c30c7ef61805efa18c46b36561284ccbd.exe"C:\Users\Admin\AppData\Local\Temp\6a5cae6d9f10a5bf3bae6240be9b655c30c7ef61805efa18c46b36561284ccbd.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5012
-
C:\Users\Admin\AppData\Local\Temp\7CA2.exeC:\Users\Admin\AppData\Local\Temp\7CA2.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵PID:4680
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵PID:844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 6322⤵
- Program crash
PID:1908
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x31c 0x4541⤵PID:4652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3532 -ip 35321⤵PID:1876
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5b5a46f5ab767dd7634ab9dec3de237f1
SHA1aa5be200af2d298e355246c4f597fe90fb248f59
SHA256d4c052cb93c7dea741e2ad6572f6d83c23a2f35bf9ca0c45155ca969cf3513a7
SHA5124c91da8bc5c790cae334051e694f3259075762505da5aab3efba7d7be5cc112f69def2ad54dab3a0f508982972362223d243406be65e23d2f1a1bfa4a12f1124
-
Filesize
1.2MB
MD5b5a46f5ab767dd7634ab9dec3de237f1
SHA1aa5be200af2d298e355246c4f597fe90fb248f59
SHA256d4c052cb93c7dea741e2ad6572f6d83c23a2f35bf9ca0c45155ca969cf3513a7
SHA5124c91da8bc5c790cae334051e694f3259075762505da5aab3efba7d7be5cc112f69def2ad54dab3a0f508982972362223d243406be65e23d2f1a1bfa4a12f1124