Analysis
- max time kernel
154s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
22/10/2022, 03:28
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target file.exe
- Size 227KB
- Sample221022-d1b4caadd2
- SHA256 48efccf35f67e0cec50e786672920f477121f9a13a02114c3116de8ad82f860d
- MD5 478db77186383a1c6af2dbc297b9d725
- SHA1 5898754481cde50a8b4fb140d9d5932663d039f3
- SHA512 769b8b6eac20980b6c610a87cf5974978241028bbdea9671180b8be05b15bd88960a13848782bfbdcace048abbe2aa96a9da265b964ba1397fe57b4235166056
- SSDEEP 3072:YXmbPLgBUKEYur5cq9y52lWmES9eGtLlssIotxkhS:scPLgB/EYuGLwlWmEG5tIyxkhS
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
danabot
C2
-
23.106.124.171:443
-
149.3.170.160:443
-
213.227.155.103:443
-
103.187.26.147:443
Attributes
-
embedded_hash
4914AD1B39A63A7A98AA0D63EE31F9A9
-
type
loader
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/1320-133-0x0000000002C70000-0x0000000002C79000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 1 IoCs
flow pid Process 68 1828 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 1428 6215.exe 1204 fbhewdr - Program crash 1 IoCs
pid pid_target Process procid_target 3392 1428 WerFault.exe 90 - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fbhewdr Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fbhewdr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fbhewdr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1320 file.exe 1320 file.exe 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found 2736 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2736 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1320 file.exe 1204 fbhewdr - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeShutdownPrivilege 392 svchost.exe Token: SeShutdownPrivilege 392 svchost.exe Token: SeCreatePagefilePrivilege 392 svchost.exe Token: SeShutdownPrivilege 2736 Process not Found Token: SeCreatePagefilePrivilege 2736 Process not Found - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2736 wrote to memory of 1428 2736 Process not Found 90 PID 2736 wrote to memory of 1428 2736 Process not Found 90 PID 2736 wrote to memory of 1428 2736 Process not Found 90 PID 1428 wrote to memory of 3832 1428 6215.exe 91 PID 1428 wrote to memory of 3832 1428 6215.exe 91 PID 1428 wrote to memory of 3832 1428 6215.exe 91 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97 PID 1428 wrote to memory of 1828 1428 6215.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1320
-
C:\Users\Admin\AppData\Local\Temp\6215.exeC:\Users\Admin\AppData\Local\Temp\6215.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵PID:3832
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:1828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 6282⤵
- Program crash
PID:3392
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:392
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2bc 0x4e41⤵PID:4592
-
C:\Users\Admin\AppData\Roaming\fbhewdrC:\Users\Admin\AppData\Roaming\fbhewdr1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1428 -ip 14281⤵PID:896
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\6215.exe
- Size 1.3MB
- SHA256 dba378cc137d90762b2e019284ea34b30b98c46e36a118e1cdd4ddca2ab8be73
- MD5 1c14f5ff278d9c547063666e3f962622
- SHA1 6c59413ad6c2ad4972d4f0576dd3b3dae01034d2
- SHA512 3ce4bbaf77ecd53af11d61f12edd2dfd7fc070c836524c305547fb4c9779bbf1c6ccc275ec5f670b585b6ee78ad70a2507fbef76dab2dae09ac7cf026ce8791f
- SSDEEP 24576:gTHYK0jmV++KxZjkCA8i5uP2lqATGs3SnFkZWkVV3n:gTHYJiEZjtA8uHi/kVF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\6215.exe
- Size 1.3MB
- SHA256 dba378cc137d90762b2e019284ea34b30b98c46e36a118e1cdd4ddca2ab8be73
- MD5 1c14f5ff278d9c547063666e3f962622
- SHA1 6c59413ad6c2ad4972d4f0576dd3b3dae01034d2
- SHA512 3ce4bbaf77ecd53af11d61f12edd2dfd7fc070c836524c305547fb4c9779bbf1c6ccc275ec5f670b585b6ee78ad70a2507fbef76dab2dae09ac7cf026ce8791f
- SSDEEP 24576:gTHYK0jmV++KxZjkCA8i5uP2lqATGs3SnFkZWkVV3n:gTHYJiEZjtA8uHi/kVF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\fbhewdr
- Size 227KB
- SHA256 48efccf35f67e0cec50e786672920f477121f9a13a02114c3116de8ad82f860d
- MD5 478db77186383a1c6af2dbc297b9d725
- SHA1 5898754481cde50a8b4fb140d9d5932663d039f3
- SHA512 769b8b6eac20980b6c610a87cf5974978241028bbdea9671180b8be05b15bd88960a13848782bfbdcace048abbe2aa96a9da265b964ba1397fe57b4235166056
- SSDEEP 3072:YXmbPLgBUKEYur5cq9y52lWmES9eGtLlssIotxkhS:scPLgB/EYuGLwlWmEG5tIyxkhS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\fbhewdr
- Size 227KB
- SHA256 48efccf35f67e0cec50e786672920f477121f9a13a02114c3116de8ad82f860d
- MD5 478db77186383a1c6af2dbc297b9d725
- SHA1 5898754481cde50a8b4fb140d9d5932663d039f3
- SHA512 769b8b6eac20980b6c610a87cf5974978241028bbdea9671180b8be05b15bd88960a13848782bfbdcace048abbe2aa96a9da265b964ba1397fe57b4235166056
- SSDEEP 3072:YXmbPLgBUKEYur5cq9y52lWmES9eGtLlssIotxkhS:scPLgB/EYuGLwlWmEG5tIyxkhS
- MD5 SHA1 SHA512 SSDEEP