Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 13:41
Static task
static1
Behavioral task
behavioral1
Sample
malware_smoke_2950363636.exe
Resource
win7-20220812-en
3 signatures
150 seconds
General
-
Target
malware_smoke_2950363636.exe
-
Size
990KB
-
MD5
b7a941ccee51c48bd6d1ec4647a84bba
-
SHA1
6dcad292e3ed53b6c585e349816a0bc1ed6efd89
-
SHA256
912e48c880423c13566dcee31ceeff8a34a66fcca0745b9645a5ff541f41aff5
-
SHA512
ee2705dd26dbde88680e20e4dad48ac4b46ec0cda72df2dc7b895d01a64a8d2f02e07e7ce106f80ed876b9ef07a692224e891a129d396711cc98f21ac35c8682
-
SSDEEP
24576:8BP9QEFEiRKoxL91U0M04Sgkcd4LMnC2:IHFdRKOL92046s4La1
Malware Config
Extracted
Family
danabot
Botnet
5
C2
104.168.167.51:443
23.254.129.180:443
23.254.133.7:443
213.227.155.102:443
Attributes
-
embedded_hash
38025B93DA95E52B49DBD6CF4413C95E
-
type
loader
Signatures
-
Blocklisted process makes network request 32 IoCs
Processes:
rundll32.exeflow pid process 11 4600 rundll32.exe 14 4600 rundll32.exe 15 4600 rundll32.exe 28 4600 rundll32.exe 36 4600 rundll32.exe 37 4600 rundll32.exe 42 4600 rundll32.exe 44 4600 rundll32.exe 45 4600 rundll32.exe 46 4600 rundll32.exe 51 4600 rundll32.exe 52 4600 rundll32.exe 53 4600 rundll32.exe 54 4600 rundll32.exe 55 4600 rundll32.exe 56 4600 rundll32.exe 58 4600 rundll32.exe 59 4600 rundll32.exe 60 4600 rundll32.exe 61 4600 rundll32.exe 62 4600 rundll32.exe 63 4600 rundll32.exe 64 4600 rundll32.exe 65 4600 rundll32.exe 66 4600 rundll32.exe 67 4600 rundll32.exe 68 4600 rundll32.exe 69 4600 rundll32.exe 70 4600 rundll32.exe 71 4600 rundll32.exe 72 4600 rundll32.exe 73 4600 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1768 2724 WerFault.exe malware_smoke_2950363636.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
malware_smoke_2950363636.exedescription pid process target process PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe PID 2724 wrote to memory of 4600 2724 malware_smoke_2950363636.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\malware_smoke_2950363636.exe"C:\Users\Admin\AppData\Local\Temp\malware_smoke_2950363636.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 6082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2724 -ip 27241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2724-132-0x00000000008E4000-0x00000000009A9000-memory.dmpFilesize
788KB
-
memory/2724-133-0x00000000023C0000-0x00000000025A5000-memory.dmpFilesize
1.9MB
-
memory/2724-134-0x0000000000400000-0x00000000005F0000-memory.dmpFilesize
1.9MB
-
memory/2724-138-0x0000000000400000-0x00000000005F0000-memory.dmpFilesize
1.9MB
-
memory/4600-135-0x0000000000000000-mapping.dmp
-
memory/4600-136-0x00000000004A0000-0x00000000004A3000-memory.dmpFilesize
12KB
-
memory/4600-137-0x00000000004B0000-0x00000000004B3000-memory.dmpFilesize
12KB
-
memory/4600-139-0x00000000004B0000-0x00000000004B3000-memory.dmpFilesize
12KB