Analysis
- max time kernel
153s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
12/10/2022, 17:18
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 302KB
- Sample221012-vt9jpsdbe6
- SHA256 ea5a00b8a983adb9e938e18782a020a849c6c2d8ec6c33965fef493f2922f4b6
- MD5 5c58750a964c33c83f0a362dd2fc978c
- SHA1 a5a1ef6a826978210d05540e13a21e5e25f335ed
- SHA512 c391bfe6967ca3a8b4a325a044cc0a45911c39a1efe02fedfcf72846ec485129d8a3d83044a3021ab218807d4f23d6945c974776229d6bdd69958a34af9ce8ea
- SSDEEP 6144:nSHUWH4CFpyUM4oWiNh0QuEkye3weigavwVf:nXWhFpdM4vQh0EeAT
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
danabot
Attributes
-
embedded_hash
56951C922035D696BFCE443750496462
-
type
loader
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4328-133-0x00000000005A0000-0x00000000005A9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 5104 3728.exe 3720 jbwcvgc - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jbwcvgc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jbwcvgc Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jbwcvgc Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4328 file.exe 4328 file.exe 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 760 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4328 file.exe 3720 jbwcvgc - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 4568 svchost.exe Token: SeShutdownPrivilege 4568 svchost.exe Token: SeCreatePagefilePrivilege 4568 svchost.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 760 wrote to memory of 5104 760 Process not Found 90 PID 760 wrote to memory of 5104 760 Process not Found 90 PID 760 wrote to memory of 5104 760 Process not Found 90 PID 5104 wrote to memory of 3456 5104 3728.exe 92 PID 5104 wrote to memory of 3456 5104 3728.exe 92 PID 5104 wrote to memory of 3456 5104 3728.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4328
-
C:\Users\Admin\AppData\Local\Temp\3728.exeC:\Users\Admin\AppData\Local\Temp\3728.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵PID:3456
-
-
C:\Users\Admin\AppData\Roaming\jbwcvgcC:\Users\Admin\AppData\Roaming\jbwcvgc1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4568
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x428 0x3141⤵PID:1032
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\3728.exe
- Size 1.4MB
- SHA256 e2f6c9308783a855be7dfcf481093025b2a871ce4649c68d0c859a8e6bf5185f
- MD5 fafee54ba70e90ab126eb44b99ac9925
- SHA1 df791e5d8cd86770a267ddf7da2b29ca1141e7b9
- SHA512 cd0527dbdf86952f810f8e6cf2af179fc5f1756077ec7af31248e2b5bcdd0029fbc0dec04dcac8898282add99ec9f8058d4d723b0c895cc989ab083e2fc6e369
- SSDEEP 24576:loEbNz+U35GNYsjFhMpsz+7qMqhzg3rfwPHiM2W7nAv+4EjA0669h1T:lobA5G+sjgL7AE7IKMxAv+4kA06Oh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3728.exe
- Size 1.4MB
- SHA256 e2f6c9308783a855be7dfcf481093025b2a871ce4649c68d0c859a8e6bf5185f
- MD5 fafee54ba70e90ab126eb44b99ac9925
- SHA1 df791e5d8cd86770a267ddf7da2b29ca1141e7b9
- SHA512 cd0527dbdf86952f810f8e6cf2af179fc5f1756077ec7af31248e2b5bcdd0029fbc0dec04dcac8898282add99ec9f8058d4d723b0c895cc989ab083e2fc6e369
- SSDEEP 24576:loEbNz+U35GNYsjFhMpsz+7qMqhzg3rfwPHiM2W7nAv+4EjA0669h1T:lobA5G+sjgL7AE7IKMxAv+4kA06Oh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\jbwcvgc
- Size 302KB
- SHA256 ea5a00b8a983adb9e938e18782a020a849c6c2d8ec6c33965fef493f2922f4b6
- MD5 5c58750a964c33c83f0a362dd2fc978c
- SHA1 a5a1ef6a826978210d05540e13a21e5e25f335ed
- SHA512 c391bfe6967ca3a8b4a325a044cc0a45911c39a1efe02fedfcf72846ec485129d8a3d83044a3021ab218807d4f23d6945c974776229d6bdd69958a34af9ce8ea
- SSDEEP 6144:nSHUWH4CFpyUM4oWiNh0QuEkye3weigavwVf:nXWhFpdM4vQh0EeAT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\jbwcvgc
- Size 302KB
- SHA256 ea5a00b8a983adb9e938e18782a020a849c6c2d8ec6c33965fef493f2922f4b6
- MD5 5c58750a964c33c83f0a362dd2fc978c
- SHA1 a5a1ef6a826978210d05540e13a21e5e25f335ed
- SHA512 c391bfe6967ca3a8b4a325a044cc0a45911c39a1efe02fedfcf72846ec485129d8a3d83044a3021ab218807d4f23d6945c974776229d6bdd69958a34af9ce8ea
- SSDEEP 6144:nSHUWH4CFpyUM4oWiNh0QuEkye3weigavwVf:nXWhFpdM4vQh0EeAT
- MD5 SHA1 SHA512 SSDEEP