Analysis
- max time kernel
152s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
21/10/2022, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target file.exe
- Size 199KB
- Sample221021-pebq8sbbfl
- SHA256 f1f053c7dcc5cdd0d65a8420acdaa7f0d45d8b9406a098e3e2b622d498e7cf35
- MD5 daed8129439edb464becc2a544b55f6a
- SHA1 88364358057e7347e222dbcab143c11dda4c4647
- SHA512 77d7b1b842381acae2fe700fa01aebb5809cbe00e2e37b4a6e1f8eaf3846d30e7a7ed20f9ccd6511d87b4eedc5b96e46e2864b5c41edde23ae2ec54184448138
- SSDEEP 3072:/XS58LL3FQfz5vtOOi4fTxBo0MUhRURlVaoZGfT5:vq8LLFQfnOOxDMUhuVJZG5
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
danabot
C2
-
23.106.124.171:443
-
149.3.170.160:443
-
213.227.155.103:443
-
103.187.26.147:443
Attributes
-
embedded_hash
4914AD1B39A63A7A98AA0D63EE31F9A9
-
type
loader
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4544-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 2 IoCs
flow pid Process 86 4504 rundll32.exe 87 4504 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 3476 6CE3.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E26DD855-0205-4700-B562-3E6CF76507B8}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{36F27DC3-9A2B-40F3-AD5A-C84A1757181B}.catalogItem svchost.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3752 3476 WerFault.exe 77 - Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4544 file.exe 4544 file.exe 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found 3004 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3004 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4544 file.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeShutdownPrivilege 4884 svchost.exe Token: SeShutdownPrivilege 4884 svchost.exe Token: SeCreatePagefilePrivilege 4884 svchost.exe Token: SeShutdownPrivilege 3004 Process not Found Token: SeCreatePagefilePrivilege 3004 Process not Found Token: SeShutdownPrivilege 3004 Process not Found Token: SeCreatePagefilePrivilege 3004 Process not Found - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3004 Process not Found 3004 Process not Found 3004 Process not Found - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3004 Process not Found 3004 Process not Found 3004 Process not Found - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3004 wrote to memory of 3476 3004 Process not Found 77 PID 3004 wrote to memory of 3476 3004 Process not Found 77 PID 3004 wrote to memory of 3476 3004 Process not Found 77 PID 3476 wrote to memory of 4856 3476 6CE3.exe 78 PID 3476 wrote to memory of 4856 3476 6CE3.exe 78 PID 3476 wrote to memory of 4856 3476 6CE3.exe 78 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102 PID 3476 wrote to memory of 4504 3476 6CE3.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4544
-
C:\Users\Admin\AppData\Local\Temp\6CE3.exeC:\Users\Admin\AppData\Local\Temp\6CE3.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵PID:4856
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:4504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 6202⤵
- Program crash
PID:3752
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4948
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x150 0x5101⤵PID:1644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3476 -ip 34761⤵PID:2156
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\6CE3.exe
- Size 1.3MB
- SHA256 d79f5e45a2fbd17a0d356f6a98ff3055feaa93386e96eaca0cc09fe102fa6b64
- MD5 c1a4f9c55a8b2d6d4198fe8e566a8e6c
- SHA1 aa8203c77398fc2fe080252102344b1db6255a1b
- SHA512 95f392f574ce0bb59c9bb7a2953500eaaf9cc1dcf710fa9a8f25a02701116b07ee0b21982b8a6d817ae3b16efbce50d252a855c03f19dbf0083600ef6e802d34
- SSDEEP 24576:YS5fuNxI4u8y7DJ4BCQtgH9xTx3mHZjvU1oULBiHnO8Wp16HNt42jKpNnLLy7i6G:YS5WNxIwyaqDQvAmsp1682ju9y7i6smU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\6CE3.exe
- Size 1.3MB
- SHA256 d79f5e45a2fbd17a0d356f6a98ff3055feaa93386e96eaca0cc09fe102fa6b64
- MD5 c1a4f9c55a8b2d6d4198fe8e566a8e6c
- SHA1 aa8203c77398fc2fe080252102344b1db6255a1b
- SHA512 95f392f574ce0bb59c9bb7a2953500eaaf9cc1dcf710fa9a8f25a02701116b07ee0b21982b8a6d817ae3b16efbce50d252a855c03f19dbf0083600ef6e802d34
- SSDEEP 24576:YS5fuNxI4u8y7DJ4BCQtgH9xTx3mHZjvU1oULBiHnO8Wp16HNt42jKpNnLLy7i6G:YS5WNxIwyaqDQvAmsp1682ju9y7i6smU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Ehyifedhphuqwyt.tmp
- Size 3.3MB
- SHA256 b3eb7c1e04daec22b1aa0dce976d971aa790b9218dfc2791ce59e93d2e241047
- MD5 6de7ac98e37e4f5763045adea655a6f4
- SHA1 6d3373daf89e65b381cef4f07973d2b0b21a53d7
- SHA512 a8af5f601ab0c9d5fcc5bc825f7292e5cd3c50b52129a4cf5d78ff6dbd582a1da0fb58f185ad0bf7fce5784ca87663b3a96554cea184ef2a3167e9432201aa77
- SSDEEP 98304:dH5KTB30bsYFgd02Ag4xIebsOqpw9+FnJ/:dH0TBNuRg4xIeAOq60Fnp
- MD5 SHA1 SHA512 SSDEEP