Analysis
-
max time kernel
189s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 13:30
Static task
static1
Behavioral task
behavioral1
Sample
malware_smoke_2586152214.exe
Resource
win7-20220812-en
3 signatures
150 seconds
General
-
Target
malware_smoke_2586152214.exe
-
Size
989KB
-
MD5
15e5ddb829c749649f99f10c90426e6c
-
SHA1
f4086a982038a0614ffa3acf7a8cbdd07c34b7d1
-
SHA256
76559476c1018ec1db4d8a692c6af3e66d394e31141f5cf47b1fdbb3ecde118c
-
SHA512
2131caa27f42dc2aca407df253a8486ef9065846043b5e5b13fd7c3f24f5a4b8ddba50ca18645f6b0f6f5a7d60b20aee49631497592bbd9383e6f3dff70f9d0f
-
SSDEEP
24576:t9JCiFuiVOFF/W7qmnYxvv0WJCC5V14y2KdZJC7:pwi4/4q3V5V1YKdv
Malware Config
Extracted
Family
danabot
Botnet
5
C2
104.168.167.51:443
23.254.129.180:443
23.254.133.7:443
213.227.155.102:443
Attributes
-
embedded_hash
38025B93DA95E52B49DBD6CF4413C95E
-
type
loader
Signatures
-
Blocklisted process makes network request 16 IoCs
Processes:
rundll32.exeflow pid process 29 3468 rundll32.exe 32 3468 rundll32.exe 33 3468 rundll32.exe 41 3468 rundll32.exe 42 3468 rundll32.exe 43 3468 rundll32.exe 44 3468 rundll32.exe 45 3468 rundll32.exe 48 3468 rundll32.exe 49 3468 rundll32.exe 50 3468 rundll32.exe 51 3468 rundll32.exe 52 3468 rundll32.exe 53 3468 rundll32.exe 54 3468 rundll32.exe 55 3468 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1868 2200 WerFault.exe malware_smoke_2586152214.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
malware_smoke_2586152214.exedescription pid process target process PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe PID 2200 wrote to memory of 3468 2200 malware_smoke_2586152214.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\malware_smoke_2586152214.exe"C:\Users\Admin\AppData\Local\Temp\malware_smoke_2586152214.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 6122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2200 -ip 22001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2200-132-0x00000000006CF000-0x0000000000794000-memory.dmpFilesize
788KB
-
memory/2200-133-0x0000000002440000-0x0000000002625000-memory.dmpFilesize
1.9MB
-
memory/2200-134-0x0000000000400000-0x00000000005F0000-memory.dmpFilesize
1.9MB
-
memory/2200-135-0x0000000002440000-0x0000000002625000-memory.dmpFilesize
1.9MB
-
memory/2200-136-0x0000000000400000-0x00000000005F0000-memory.dmpFilesize
1.9MB
-
memory/3468-137-0x0000000000000000-mapping.dmp
-
memory/3468-138-0x0000000001200000-0x0000000001203000-memory.dmpFilesize
12KB
-
memory/3468-139-0x0000000001210000-0x0000000001213000-memory.dmpFilesize
12KB
-
memory/3468-140-0x0000000001220000-0x0000000001223000-memory.dmpFilesize
12KB
-
memory/3468-141-0x0000000001230000-0x0000000001233000-memory.dmpFilesize
12KB
-
memory/3468-142-0x0000000001240000-0x0000000001243000-memory.dmpFilesize
12KB
-
memory/3468-143-0x0000000001250000-0x0000000001253000-memory.dmpFilesize
12KB
-
memory/3468-144-0x0000000001260000-0x0000000001263000-memory.dmpFilesize
12KB
-
memory/3468-145-0x0000000001270000-0x0000000001273000-memory.dmpFilesize
12KB
-
memory/3468-146-0x0000000001280000-0x0000000001283000-memory.dmpFilesize
12KB
-
memory/3468-147-0x0000000001290000-0x0000000001293000-memory.dmpFilesize
12KB
-
memory/3468-148-0x00000000012A0000-0x00000000012A3000-memory.dmpFilesize
12KB
-
memory/3468-149-0x00000000012B0000-0x00000000012B3000-memory.dmpFilesize
12KB