Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
06-10-2022 02:58
Static task
static1
Behavioral task
behavioral1
Sample
c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exe
Resource
win10-20220901-en
General
-
Target
c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exe
-
Size
146KB
-
MD5
8fa7831afc81ab0935ba578f113e4fbf
-
SHA1
53d4ff86d30e0f6067e2c6fef5747ea235abeaeb
-
SHA256
c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224
-
SHA512
6627c75bd614035c4daa776420202fa646531b562c1043cd6e6480a75408fa2bf31efe30a1786cb25bf651a2262ee2ea249305c7c908793dffbd65392e0b6dac
-
SSDEEP
3072:6IFX9IR8hfVMjTgD+QiOZTeL15kT+YHZIYUBMGTYO:JTbYWZe1s+8eGGTY
Malware Config
Extracted
danabot
-
embedded_hash
EAD30BF58E340E9E105B328F524565E0
-
type
loader
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3048-150-0x00000000001E0000-0x00000000001E9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
2A5C.exehddeiahpid process 4384 2A5C.exe 3688 hddeiah -
Deletes itself 1 IoCs
Processes:
pid process 3036 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exehddeiahdescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hddeiah Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hddeiah Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hddeiah Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exepid process 3048 c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exe 3048 c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exe 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3036 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exehddeiahpid process 3048 c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exe 3688 hddeiah -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2A5C.exedescription pid process target process PID 3036 wrote to memory of 4384 3036 2A5C.exe PID 3036 wrote to memory of 4384 3036 2A5C.exe PID 3036 wrote to memory of 4384 3036 2A5C.exe PID 4384 wrote to memory of 784 4384 2A5C.exe appidtel.exe PID 4384 wrote to memory of 784 4384 2A5C.exe appidtel.exe PID 4384 wrote to memory of 784 4384 2A5C.exe appidtel.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exe"C:\Users\Admin\AppData\Local\Temp\c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2A5C.exeC:\Users\Admin\AppData\Local\Temp\2A5C.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
C:\Users\Admin\AppData\Roaming\hddeiahC:\Users\Admin\AppData\Roaming\hddeiah1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2A5C.exeFilesize
4.5MB
MD562ba89d7affbfbcfbf23cde2b99db94d
SHA114cc964af2597640ae4eced7a97c0f51f5374655
SHA256c7831dd1563f5fc62f794d0849831d2b12aaa1e094c4d66d6e74d656b75f4bc6
SHA5127bd88e1c59b4aa95f29ca4fe3bf7e06fb8afa54c91d794d9b6b2b041b7ea19923144158d77ee737da8414aba0a776254e0c507498b14fec9d9cbb5fd7bb71779
-
C:\Users\Admin\AppData\Local\Temp\2A5C.exeFilesize
4.5MB
MD562ba89d7affbfbcfbf23cde2b99db94d
SHA114cc964af2597640ae4eced7a97c0f51f5374655
SHA256c7831dd1563f5fc62f794d0849831d2b12aaa1e094c4d66d6e74d656b75f4bc6
SHA5127bd88e1c59b4aa95f29ca4fe3bf7e06fb8afa54c91d794d9b6b2b041b7ea19923144158d77ee737da8414aba0a776254e0c507498b14fec9d9cbb5fd7bb71779
-
C:\Users\Admin\AppData\Roaming\hddeiahFilesize
146KB
MD58fa7831afc81ab0935ba578f113e4fbf
SHA153d4ff86d30e0f6067e2c6fef5747ea235abeaeb
SHA256c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224
SHA5126627c75bd614035c4daa776420202fa646531b562c1043cd6e6480a75408fa2bf31efe30a1786cb25bf651a2262ee2ea249305c7c908793dffbd65392e0b6dac
-
C:\Users\Admin\AppData\Roaming\hddeiahFilesize
146KB
MD58fa7831afc81ab0935ba578f113e4fbf
SHA153d4ff86d30e0f6067e2c6fef5747ea235abeaeb
SHA256c3848a7b568395cc0dec3c0c7a1dcd72ecd092e505b9bc9e9879dc633d69b224
SHA5126627c75bd614035c4daa776420202fa646531b562c1043cd6e6480a75408fa2bf31efe30a1786cb25bf651a2262ee2ea249305c7c908793dffbd65392e0b6dac
-
memory/784-222-0x0000000000000000-mapping.dmp
-
memory/3036-185-0x00000000022A0000-0x00000000022B0000-memory.dmpFilesize
64KB
-
memory/3036-183-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-331-0x0000000004790000-0x00000000047A0000-memory.dmpFilesize
64KB
-
memory/3036-264-0x0000000002910000-0x0000000002920000-memory.dmpFilesize
64KB
-
memory/3036-263-0x0000000002910000-0x0000000002920000-memory.dmpFilesize
64KB
-
memory/3036-262-0x0000000002910000-0x0000000002920000-memory.dmpFilesize
64KB
-
memory/3036-261-0x0000000002910000-0x0000000002920000-memory.dmpFilesize
64KB
-
memory/3036-260-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-259-0x0000000000660000-0x0000000000670000-memory.dmpFilesize
64KB
-
memory/3036-332-0x0000000004790000-0x00000000047A0000-memory.dmpFilesize
64KB
-
memory/3036-333-0x0000000004790000-0x00000000047A0000-memory.dmpFilesize
64KB
-
memory/3036-330-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-188-0x00000000022A0000-0x00000000022B0000-memory.dmpFilesize
64KB
-
memory/3036-187-0x00000000022A0000-0x00000000022B0000-memory.dmpFilesize
64KB
-
memory/3036-186-0x00000000022A0000-0x00000000022B0000-memory.dmpFilesize
64KB
-
memory/3036-162-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-184-0x0000000000770000-0x0000000000780000-memory.dmpFilesize
64KB
-
memory/3036-329-0x0000000000660000-0x0000000000670000-memory.dmpFilesize
64KB
-
memory/3036-182-0x0000000000660000-0x0000000000670000-memory.dmpFilesize
64KB
-
memory/3036-181-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-180-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-179-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-178-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-175-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-174-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-173-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-172-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-171-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-170-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-167-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-166-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-165-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-164-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-157-0x0000000000660000-0x0000000000670000-memory.dmpFilesize
64KB
-
memory/3036-159-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3048-143-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-128-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-153-0x000000000070A000-0x000000000071A000-memory.dmpFilesize
64KB
-
memory/3048-149-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-152-0x0000000000400000-0x0000000000581000-memory.dmpFilesize
1.5MB
-
memory/3048-151-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-150-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/3048-148-0x000000000070A000-0x000000000071A000-memory.dmpFilesize
64KB
-
memory/3048-147-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-146-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-145-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-144-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-142-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-117-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-141-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-140-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-139-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-137-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-138-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-136-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-135-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-134-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-118-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-133-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-119-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-120-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-121-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-122-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-123-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-124-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-125-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-126-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-127-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-154-0x0000000000400000-0x0000000000581000-memory.dmpFilesize
1.5MB
-
memory/3048-132-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-129-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-130-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3048-131-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3688-303-0x0000000000590000-0x000000000063E000-memory.dmpFilesize
696KB
-
memory/3688-305-0x0000000000400000-0x0000000000581000-memory.dmpFilesize
1.5MB
-
memory/3688-304-0x0000000000400000-0x0000000000581000-memory.dmpFilesize
1.5MB
-
memory/3688-302-0x0000000000839000-0x000000000084A000-memory.dmpFilesize
68KB
-
memory/4384-202-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-196-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-205-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-203-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-201-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-200-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-199-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-197-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-266-0x0000000000400000-0x0000000000A22000-memory.dmpFilesize
6.1MB
-
memory/4384-237-0x0000000002950000-0x0000000002DC0000-memory.dmpFilesize
4.4MB
-
memory/4384-195-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-236-0x0000000000400000-0x0000000000A22000-memory.dmpFilesize
6.1MB
-
memory/4384-235-0x0000000002DC0000-0x00000000033D6000-memory.dmpFilesize
6.1MB
-
memory/4384-234-0x0000000002950000-0x0000000002DC0000-memory.dmpFilesize
4.4MB
-
memory/4384-204-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-194-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-193-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-192-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-191-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4384-189-0x0000000000000000-mapping.dmp