Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
20-12-2022 09:49
General
-
Target
14d27e8cf4d45d944227148e218dabad.exe
-
Size
218KB
-
MD5
14d27e8cf4d45d944227148e218dabad
-
SHA1
64829bacebf8be9d3e16b21b1a607124cb23dc01
-
SHA256
881c03c857c94709c03fcfbd8cf9bfc11b3d1f3579f0198a88e646d62575ee58
-
SHA512
0672d6d2359d1554267cb010900248627eed7e0fe35bdd8e2fa07a3847ed95a89e253d156cc2ca60d93b69336963d54f519762f4cd1b6ef2c87e941f96564971
-
SSDEEP
3072:FTPEC+Lfi8P9RUUBlhxdM/agCEuMRSdso06fWR7b/T7NHCDml:FrF+LK8AUt3rIqxDfWJNCa
Malware Config
Extracted
systembc
109.205.214.18:443
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Blocklisted process makes network request 3 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 34 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 25 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 30 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 30 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14d27e8cf4d45d944227148e218dabad.exe"C:\Users\Admin\AppData\Local\Temp\14d27e8cf4d45d944227148e218dabad.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\16B4.exeC:\Users\Admin\AppData\Local\Temp\16B4.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 141503⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 5362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 908 -ip 9081⤵
-
C:\Users\Admin\AppData\Local\Temp\3D19.exeC:\Users\Admin\AppData\Local\Temp\3D19.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 4882⤵
- Program crash
-
-
C:\ProgramData\gfmnuce\koatoi.exeC:\ProgramData\gfmnuce\koatoi.exe start1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\jthcieaC:\Users\Admin\AppData\Roaming\jthciea1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3308 -ip 33081⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\fillandsign.dll",fUozM1FxVg==2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
797KB
MD537391f45ab04753a1e368fdcb513dc81
SHA1042e30d2ae40f66b308bdbad9fbf7c2c72387dba
SHA256093e64d760c6ec2acacf1dc2fac01448096e82d9413c0947daa3bfb8f1de0801
SHA51247bf42e142d87cc6c1d2a39629804ae9f750eb442074e6d57170b38453e5c9e5b32b92c9748fb629229385184b4442e9da6e101c2990792ad43bfd5f8f79d673
-
Filesize
797KB
MD537391f45ab04753a1e368fdcb513dc81
SHA1042e30d2ae40f66b308bdbad9fbf7c2c72387dba
SHA256093e64d760c6ec2acacf1dc2fac01448096e82d9413c0947daa3bfb8f1de0801
SHA51247bf42e142d87cc6c1d2a39629804ae9f750eb442074e6d57170b38453e5c9e5b32b92c9748fb629229385184b4442e9da6e101c2990792ad43bfd5f8f79d673
-
Filesize
218KB
MD5cdc67700f25eaed1417264c4bdec03d3
SHA156639e9414e6ee8394d940d62778475ddf071290
SHA256fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
SHA512a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038
-
Filesize
218KB
MD5cdc67700f25eaed1417264c4bdec03d3
SHA156639e9414e6ee8394d940d62778475ddf071290
SHA256fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
SHA512a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038
-
Filesize
14KB
MD5fffde3df0d91311b7fe3f9bc8642a9ec
SHA150987906817aab51e2cc29fbce47ac5f0936a44e
SHA256bda9df3591bf7f67d4b31d23cffdcf927da6f00ae1b393f07aea69ba1c4344bc
SHA5125e0766c25f54b03ca0325966ba059cbfb9cdb0aeae567106583fdff944d67522516acabb9b261e2fd434c1a5af5c5453a09c9dc494008253b0553a993c01d3d3
-
Filesize
109KB
MD51ff29aea22999055b5c3dda5785a807c
SHA1cd93580b22754e44c6fda2b1127bf6539deea0c6
SHA256a738adb72546d0ea134a20abe3adbeb8bc6c7b90d04cc72d2f217c154c83ce11
SHA512ab28afe92584956fd6656d05a9e910bf45312b2f7b23e97ab92e4a95ae014300c16a509c1e81dc18c7e180cf9c6a74a2146cf0b53083a4d9c99c0eb97b0323c5
-
Filesize
240B
MD5d20640a3df79babef40bad01d40cc900
SHA11b1f40b0a8a9bbb5550625636e87a7192a254dd6
SHA2564d40459c351cfa95b5a21e65e0bcdee4f401a00a42ae95990dd2213763dc357e
SHA512fa5513b0fc300974b5cf07b9044d854022f5c9f88ce2e69678f9ae33b6bc2fb559280190eae019ae026870f8d5394854526ad5a650007e555feed4b8810ad017
-
Filesize
2.3MB
MD57e7e9913cbc2497e0de312f9931a96e7
SHA1b69cd001fe4fdc568096b154f3a7b80854710197
SHA25631ef6be3a2591a2ff4f349185d3ac4c63b49ba9448f95ad9c2accdaa65c4b06e
SHA5121e98175603fe61868f566e5cd874b5f394353e227f558aeed108998df81f464f60f494083079472291f619fae7e18cfbfbf9188178d480095b346a3ccd09477d
-
Filesize
2.3MB
MD57e7e9913cbc2497e0de312f9931a96e7
SHA1b69cd001fe4fdc568096b154f3a7b80854710197
SHA25631ef6be3a2591a2ff4f349185d3ac4c63b49ba9448f95ad9c2accdaa65c4b06e
SHA5121e98175603fe61868f566e5cd874b5f394353e227f558aeed108998df81f464f60f494083079472291f619fae7e18cfbfbf9188178d480095b346a3ccd09477d
-
Filesize
2KB
MD52ff808c347a1bd28f3df3bc8873d73d6
SHA1afc3b29446a1e5ea641db1c5f1521b2f5c814581
SHA2566d6bb6749a28b69f42fede441d1c84dbff9c3f69938e637eee4fc260d0c92301
SHA51233c2861f5b1f0b87be1f7a5d59313d5977d284ba70a126541f2daed6297ac35cf11c4f43107148f05da7e4748f49b3e99335d4c2164ba04e0a4f17830afd1706
-
Filesize
24KB
MD556cc188f572451b90ca1f71b44ac4e64
SHA1790a449a478a6fbfd0fa2cc38d541ee62098746b
SHA256df14300ee7cae37c4264ca6b10a60e30f8f94cba7b0e6430576decbf031c4eaa
SHA5121b42c9e22cf3b8cb0433716364f8f775368c175ddce94026ae30743c352b73a1c4574603967120d28fdcad1f8cf977104f907c7f8140c41b2064d6658945fd83
-
Filesize
913B
MD51600f66ce0d9c342eb6a49155a2f8c14
SHA1e13fdac3eb45a9d47f965b2f2cf7f2ff4893af07
SHA2568dcf324dfacd70d3e32cd9423bf9067f3cbc50929dee5154bdaa531c84a9dc27
SHA512ed27ee001fefa4d7ae3ab0fe2cb1059f277692eb0b6fddb6092467ec67cfdacc3db2252e8700095ccaf503e7ca0c7942771614b1b2a0b800fd27daa30ebb5b00
-
Filesize
2KB
MD5e3a68bbd204d36868c6f5570e4576675
SHA1bc5c44144e8e962c62f7febabdb3d0ba20a8162a
SHA25611031974100f363daebe2d5c9e4bf67418d662c73e0341eb71e10b91a33280ac
SHA5127c435d9f0e05469979ac3ce3153ad96ac1b01c9946b3df7230b384cc3ed1a2766dfbad0eb00fa1f2105d0fc0e5a87cbc1eb2c6c700c1041ebe4488a6d16c2f02
-
Filesize
3KB
MD59663230fbff7b7ea27acf7cb5b2eb224
SHA1c9061dc5a74944235155461a761456af38ec7de5
SHA256189d7c143926ab4402258ecf47d9b4a6a2b55aa7564b853ddd81bbfcd2113bdb
SHA512b96f74946a99d9cca64f7727dd0664fafd16a6a1242af773b36c5f531c071dbf1b91ff873962be2cd160bdcc128b3aaa5715a38f997e5cfa1b78863ab146493d
-
Filesize
5KB
MD5d7ee4543371744836d520e0ce24a9ee6
SHA1a6cda6aac3e480b269b9da2bd616bdb4d6fa87f0
SHA25698817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9
SHA512e15b6a50d9d498918a81488bf8d60860027f9a38f4d87e239f1c6e9d20fe4938e75861dad35c69e4087370c18b2cd5b482ab6ca694dfe205d053f1d303d17808
-
Filesize
1.1MB
MD5c8beb87469647c6fb577d2bfec8e0fcd
SHA1dcbbd759d34cb4d23c53d67943c47a250ee32767
SHA256c0ada9e11f5005b3b81f34b522c43ef087fb77e1444bfe902bcaf6dfad22e8c6
SHA512678bbc9fcaa886d4babf499303afdbdf737d0e98d830bc404bcd74255742595229fa99c757f2b6c90b729b3fe260faecd2928405aaa641d774fda96fd80870fd
-
Filesize
1.1MB
MD5c8beb87469647c6fb577d2bfec8e0fcd
SHA1dcbbd759d34cb4d23c53d67943c47a250ee32767
SHA256c0ada9e11f5005b3b81f34b522c43ef087fb77e1444bfe902bcaf6dfad22e8c6
SHA512678bbc9fcaa886d4babf499303afdbdf737d0e98d830bc404bcd74255742595229fa99c757f2b6c90b729b3fe260faecd2928405aaa641d774fda96fd80870fd
-
Filesize
218KB
MD5cdc67700f25eaed1417264c4bdec03d3
SHA156639e9414e6ee8394d940d62778475ddf071290
SHA256fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
SHA512a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038
-
Filesize
218KB
MD5cdc67700f25eaed1417264c4bdec03d3
SHA156639e9414e6ee8394d940d62778475ddf071290
SHA256fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
SHA512a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038
-
Filesize
797KB
MD524925b25552a7d8f1d3292071e545920
SHA1f786e1d40df30f6fed0301d60c823b655f2d6eac
SHA2569931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b
SHA512242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26
-
Filesize
797KB
MD524925b25552a7d8f1d3292071e545920
SHA1f786e1d40df30f6fed0301d60c823b655f2d6eac
SHA2569931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b
SHA512242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26
-
Filesize
218KB
MD514d27e8cf4d45d944227148e218dabad
SHA164829bacebf8be9d3e16b21b1a607124cb23dc01
SHA256881c03c857c94709c03fcfbd8cf9bfc11b3d1f3579f0198a88e646d62575ee58
SHA5120672d6d2359d1554267cb010900248627eed7e0fe35bdd8e2fa07a3847ed95a89e253d156cc2ca60d93b69336963d54f519762f4cd1b6ef2c87e941f96564971
-
Filesize
218KB
MD514d27e8cf4d45d944227148e218dabad
SHA164829bacebf8be9d3e16b21b1a607124cb23dc01
SHA256881c03c857c94709c03fcfbd8cf9bfc11b3d1f3579f0198a88e646d62575ee58
SHA5120672d6d2359d1554267cb010900248627eed7e0fe35bdd8e2fa07a3847ed95a89e253d156cc2ca60d93b69336963d54f519762f4cd1b6ef2c87e941f96564971
-
Filesize
797KB
MD537391f45ab04753a1e368fdcb513dc81
SHA1042e30d2ae40f66b308bdbad9fbf7c2c72387dba
SHA256093e64d760c6ec2acacf1dc2fac01448096e82d9413c0947daa3bfb8f1de0801
SHA51247bf42e142d87cc6c1d2a39629804ae9f750eb442074e6d57170b38453e5c9e5b32b92c9748fb629229385184b4442e9da6e101c2990792ad43bfd5f8f79d673
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
64KB
-
Filesize
956KB
-
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
380KB
-
Filesize
68KB
-
-
Filesize
68KB
-
Filesize
380KB
-
Filesize
68KB
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
380KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
-
Filesize
1.2MB
-
Filesize
68KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
36KB
