Analysis Overview
SHA256
6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578
Threat Level: Known bad
The file 6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578 was found to be: Known bad.
Malicious Activity Summary
Danabot
SmokeLoader
Detects Smokeloader packer
Downloads MZ/PE file
Executes dropped EXE
Loads dropped DLL
Program crash
Checks SCSI registry key(s)
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-12-18 08:17
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-12-18 08:17
Reported
2022-12-18 08:20
Platform
win10v2004-20221111-en
Max time kernel
150s
Max time network
144s
Command Line
Signatures
Danabot
Detects Smokeloader packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
SmokeLoader
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4074.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\sjrdcjb | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\4074.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Roaming\sjrdcjb | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Roaming\sjrdcjb | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Roaming\sjrdcjb | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\sjrdcjb | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2480 wrote to memory of 2760 | N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4074.exe |
| PID 2480 wrote to memory of 2760 | N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4074.exe |
| PID 2480 wrote to memory of 2760 | N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4074.exe |
| PID 2760 wrote to memory of 4540 | N/A | C:\Users\Admin\AppData\Local\Temp\4074.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 2760 wrote to memory of 4540 | N/A | C:\Users\Admin\AppData\Local\Temp\4074.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 2760 wrote to memory of 4540 | N/A | C:\Users\Admin\AppData\Local\Temp\4074.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578.exe
"C:\Users\Admin\AppData\Local\Temp\6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578.exe"
C:\Users\Admin\AppData\Local\Temp\4074.exe
C:\Users\Admin\AppData\Local\Temp\4074.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll,start
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2760 -ip 2760
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 480
C:\Users\Admin\AppData\Roaming\sjrdcjb
C:\Users\Admin\AppData\Roaming\sjrdcjb
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | dowe.at | udp |
| N/A | 91.195.240.101:80 | dowe.at | tcp |
| N/A | 8.8.8.8:53 | xisac.com | udp |
| N/A | 95.107.163.44:80 | xisac.com | tcp |
| N/A | 93.184.220.29:80 | tcp | |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 20.189.173.12:443 | tcp | |
| N/A | 195.158.3.162:80 | xisac.com | tcp |
| N/A | 95.107.163.44:80 | xisac.com | tcp |
| N/A | 95.107.163.44:80 | xisac.com | tcp |
| N/A | 95.107.163.44:80 | xisac.com | tcp |
| N/A | 95.107.163.44:80 | xisac.com | tcp |
| N/A | 149.3.170.140:80 | 149.3.170.140 | tcp |
| N/A | 95.107.163.44:80 | xisac.com | tcp |
| N/A | 95.107.163.44:80 | xisac.com | tcp |
| N/A | 95.107.163.44:80 | xisac.com | tcp |
| N/A | 95.107.163.44:80 | xisac.com | tcp |
| N/A | 95.107.163.44:80 | xisac.com | tcp |
| N/A | 95.107.163.44:80 | xisac.com | tcp |
| N/A | 95.107.163.44:80 | xisac.com | tcp |
| N/A | 104.80.225.205:443 | tcp |
Files
memory/2500-132-0x00000000006E2000-0x00000000006F2000-memory.dmp
memory/2500-133-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/2500-134-0x0000000000400000-0x000000000045F000-memory.dmp
memory/2500-135-0x0000000000400000-0x000000000045F000-memory.dmp
memory/2760-136-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\4074.exe
| MD5 | 6e10b6107066da8b83187a14c8b68b23 |
| SHA1 | bfe5bb0d1fbd503226abf58fbd88e91e8f17ba05 |
| SHA256 | 804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e |
| SHA512 | 6f4715008d918f0a940bae3970e072c39b16a6c8fb66f10bc32c4b611c93a437b3475646d0fafa3e814af6d5013a518ba5893c2c984b558f66733b4d03f83461 |
C:\Users\Admin\AppData\Local\Temp\4074.exe
| MD5 | 6e10b6107066da8b83187a14c8b68b23 |
| SHA1 | bfe5bb0d1fbd503226abf58fbd88e91e8f17ba05 |
| SHA256 | 804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e |
| SHA512 | 6f4715008d918f0a940bae3970e072c39b16a6c8fb66f10bc32c4b611c93a437b3475646d0fafa3e814af6d5013a518ba5893c2c984b558f66733b4d03f83461 |
memory/2760-139-0x0000000000C75000-0x0000000000EC0000-memory.dmp
memory/2760-140-0x0000000002670000-0x00000000029F5000-memory.dmp
memory/2760-141-0x0000000000400000-0x0000000000791000-memory.dmp
memory/4540-142-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
| MD5 | c144e146ff6b53a979bb0a7733301249 |
| SHA1 | 6b648baf0069d293dcff7b71e59695dc1356e905 |
| SHA256 | 13370ccf3099b560350a7c7a3e4fe1185984983ee72312d1eff181d9a0b27aed |
| SHA512 | b3e35a13f2477b899961196bfd013de784edc22266598cbfe9726a343bc7998fa03c6852c5f0c5dfc35304f8eaeeb0cb11385f2e098e8179809e50335443b200 |
C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
| MD5 | c144e146ff6b53a979bb0a7733301249 |
| SHA1 | 6b648baf0069d293dcff7b71e59695dc1356e905 |
| SHA256 | 13370ccf3099b560350a7c7a3e4fe1185984983ee72312d1eff181d9a0b27aed |
| SHA512 | b3e35a13f2477b899961196bfd013de784edc22266598cbfe9726a343bc7998fa03c6852c5f0c5dfc35304f8eaeeb0cb11385f2e098e8179809e50335443b200 |
memory/4540-145-0x0000000000400000-0x0000000000671000-memory.dmp
memory/2760-146-0x0000000000400000-0x0000000000791000-memory.dmp
memory/4540-147-0x0000000000400000-0x0000000000671000-memory.dmp
C:\Users\Admin\AppData\Roaming\sjrdcjb
| MD5 | e56b99e9aa41ef33cabc2fed9135eda7 |
| SHA1 | bb48bbbdad29d3d15e5916913c4cbe93496aa2c8 |
| SHA256 | 6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578 |
| SHA512 | aa24a8808f156e75abf1dde8dd5f1dd009581e7b41fa06d3cd5b61f99a37f2bf2a4452143cb50a2fab0e8a6fe7220a8d766529c665a0d53dcc79d010d7e8bb9b |
C:\Users\Admin\AppData\Roaming\sjrdcjb
| MD5 | e56b99e9aa41ef33cabc2fed9135eda7 |
| SHA1 | bb48bbbdad29d3d15e5916913c4cbe93496aa2c8 |
| SHA256 | 6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578 |
| SHA512 | aa24a8808f156e75abf1dde8dd5f1dd009581e7b41fa06d3cd5b61f99a37f2bf2a4452143cb50a2fab0e8a6fe7220a8d766529c665a0d53dcc79d010d7e8bb9b |
memory/4228-150-0x0000000000593000-0x00000000005A3000-memory.dmp
memory/4228-151-0x0000000000400000-0x000000000045F000-memory.dmp
memory/4228-152-0x0000000000400000-0x000000000045F000-memory.dmp