Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2022 11:30
Static task
static1
Behavioral task
behavioral1
Sample
105eeed08455f033414ef883eba83dfd87dc77653cf82b7c3f61dd960699e5f7.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
22 signatures
150 seconds
General
-
Target
105eeed08455f033414ef883eba83dfd87dc77653cf82b7c3f61dd960699e5f7.exe
-
Size
213KB
-
MD5
1e5c136cf7bc0f4b811f6b9beb451291
-
SHA1
256c01c08a75588eae5457608716928f7a7d4550
-
SHA256
105eeed08455f033414ef883eba83dfd87dc77653cf82b7c3f61dd960699e5f7
-
SHA512
1ae260ecb9bf0da55590bc838b8837cc1c7d7cfeed3aeb94ec902fe612db3c54f89a3a97322a0a3421786374ea47cf04a4c7bf2fdac394bd6b24c85dd3ef43e6
-
SSDEEP
3072:fIBKtfL/vJRSAMzYRjQXjMApzkpVpKXC+g3uuq3HOil3lk025PH:gBefLHqhz80IApIIXCP+uq3jlVklPH
Score
10/10
Malware Config
Extracted
Family
danabot
C2
23.236.181.126:443
123.253.35.251:443
66.85.173.3:443
Attributes
-
embedded_hash
8F56CD73F6B5CD5D7B17B0BA61E70A82
-
type
loader
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/4272-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 3 IoCs
flow pid Process 39 4756 rundll32.exe 42 4756 rundll32.exe 59 4756 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4784 E0A1.exe -
Loads dropped DLL 2 IoCs
pid Process 4756 rundll32.exe 4756 rundll32.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4756 set thread context of 2124 4756 rundll32.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1116 4784 WerFault.exe 84 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 105eeed08455f033414ef883eba83dfd87dc77653cf82b7c3f61dd960699e5f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 105eeed08455f033414ef883eba83dfd87dc77653cf82b7c3f61dd960699e5f7.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 105eeed08455f033414ef883eba83dfd87dc77653cf82b7c3f61dd960699e5f7.exe -
Checks processor information in registry 2 TTPs 22 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000009255f163100054656d7000003a0009000400efbe6b558a6c9255f6632e000000000000000000000000000000000000000000000000001fb1f100540065006d007000000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 700 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4272 105eeed08455f033414ef883eba83dfd87dc77653cf82b7c3f61dd960699e5f7.exe 4272 105eeed08455f033414ef883eba83dfd87dc77653cf82b7c3f61dd960699e5f7.exe 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found 700 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 700 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4272 105eeed08455f033414ef883eba83dfd87dc77653cf82b7c3f61dd960699e5f7.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeShutdownPrivilege 700 Process not Found Token: SeCreatePagefilePrivilege 700 Process not Found Token: SeShutdownPrivilege 700 Process not Found Token: SeCreatePagefilePrivilege 700 Process not Found Token: SeShutdownPrivilege 700 Process not Found Token: SeCreatePagefilePrivilege 700 Process not Found Token: SeShutdownPrivilege 700 Process not Found Token: SeCreatePagefilePrivilege 700 Process not Found Token: SeShutdownPrivilege 700 Process not Found Token: SeCreatePagefilePrivilege 700 Process not Found Token: SeShutdownPrivilege 700 Process not Found Token: SeCreatePagefilePrivilege 700 Process not Found Token: SeShutdownPrivilege 700 Process not Found Token: SeCreatePagefilePrivilege 700 Process not Found Token: SeShutdownPrivilege 700 Process not Found Token: SeCreatePagefilePrivilege 700 Process not Found Token: SeShutdownPrivilege 700 Process not Found Token: SeCreatePagefilePrivilege 700 Process not Found Token: SeShutdownPrivilege 700 Process not Found Token: SeCreatePagefilePrivilege 700 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2124 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 700 Process not Found 700 Process not Found -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 700 wrote to memory of 4784 700 Process not Found 84 PID 700 wrote to memory of 4784 700 Process not Found 84 PID 700 wrote to memory of 4784 700 Process not Found 84 PID 4784 wrote to memory of 4756 4784 E0A1.exe 87 PID 4784 wrote to memory of 4756 4784 E0A1.exe 87 PID 4784 wrote to memory of 4756 4784 E0A1.exe 87 PID 4756 wrote to memory of 2124 4756 rundll32.exe 91 PID 4756 wrote to memory of 2124 4756 rundll32.exe 91 PID 4756 wrote to memory of 2124 4756 rundll32.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\105eeed08455f033414ef883eba83dfd87dc77653cf82b7c3f61dd960699e5f7.exe"C:\Users\Admin\AppData\Local\Temp\105eeed08455f033414ef883eba83dfd87dc77653cf82b7c3f61dd960699e5f7.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4272
-
C:\Users\Admin\AppData\Local\Temp\E0A1.exeC:\Users\Admin\AppData\Local\Temp\E0A1.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll,start2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 202033⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2124
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 5082⤵
- Program crash
PID:1116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4784 -ip 47841⤵PID:4568
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD55dcd48a0bd3fde2644210494e270babb
SHA18f41649be45702cbaf4cf28b786675fcd2147c97
SHA25638f2183ab80dfc4f3c61e7df7228db4acf21e339d3c588f25b91030029437bc4
SHA512514271a6d9f3678d0fc0fd92bd35d9ff6f5ebff04baa5fd6c9b4e2a2781f54f3d350e480f0e12b7264064bf174b7b00507bdea0b980407a9d98c8d03fb0a3f81
-
Filesize
2.4MB
MD55dcd48a0bd3fde2644210494e270babb
SHA18f41649be45702cbaf4cf28b786675fcd2147c97
SHA25638f2183ab80dfc4f3c61e7df7228db4acf21e339d3c588f25b91030029437bc4
SHA512514271a6d9f3678d0fc0fd92bd35d9ff6f5ebff04baa5fd6c9b4e2a2781f54f3d350e480f0e12b7264064bf174b7b00507bdea0b980407a9d98c8d03fb0a3f81
-
Filesize
2.4MB
MD5b5625d3fd4e1245a0a9a7ada265f5c9a
SHA10970daaafb0da72f85f5438aa251f1a7e0eab89d
SHA256bf1ca279222769ba227a88dabb05c05da06e1dab10872d5ab6e2acda82a7d968
SHA51218386f91d6e14e3c09d83e1c2f2504ac231766533f2be9a869236ba40c4268919d37bfda3336a92ebf9a889051c3427feff649b34fe44d66edd72b5686f6bd82
-
Filesize
2.4MB
MD5b5625d3fd4e1245a0a9a7ada265f5c9a
SHA10970daaafb0da72f85f5438aa251f1a7e0eab89d
SHA256bf1ca279222769ba227a88dabb05c05da06e1dab10872d5ab6e2acda82a7d968
SHA51218386f91d6e14e3c09d83e1c2f2504ac231766533f2be9a869236ba40c4268919d37bfda3336a92ebf9a889051c3427feff649b34fe44d66edd72b5686f6bd82
-
Filesize
2.4MB
MD5b5625d3fd4e1245a0a9a7ada265f5c9a
SHA10970daaafb0da72f85f5438aa251f1a7e0eab89d
SHA256bf1ca279222769ba227a88dabb05c05da06e1dab10872d5ab6e2acda82a7d968
SHA51218386f91d6e14e3c09d83e1c2f2504ac231766533f2be9a869236ba40c4268919d37bfda3336a92ebf9a889051c3427feff649b34fe44d66edd72b5686f6bd82