Analysis
- max time kernel
149s - max time network
148s - resource
win10v191014 - submitted
03/02/2020, 11:30
Task
task1
Sample
AXO23516563548321.vbs
Resource
win7v191014
0 signatures
Task
task2
Sample
AXO23516563548321.vbs
Resource
win10v191014
0 signatures
Static task
static1
General
- Target AXO23516563548321.vbs
- Size 4.6MB
- Sample200203-dsclmgmn4x
- SHA256 eb7289b966dadc5ea1f99ca35cde7fc4f2380426f632a2bedb98e26fea9d44f4
- MD5 9c2592eb51ea3339ee113d151b623d55
- SHA1 da4af1db47dfe8b257ac53f754975598bc8b1a1c
- SHA512 b5d3367429f1cd538b59dbeb75ed3b49f43f8a4419d6ffcd34ffb6541e2163e6470bba084e0ba8ed8c07df52a717a28125e29603c9ad168b7d91bca9fd0aca57
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
danabot
C2
-
199.247.16.30
-
64.188.22.153
-
64.188.23.155
-
64.188.22.33
-
64.188.22.154
-
64.188.22.122
-
64.188.22.155
-
64.188.22.156
-
64.188.23.31
-
209.250.243.55
rsa_pubkey.plain
Signatures
- Danabot x86 payload 2 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
resource yara_rule task2/files/0x000100000001b00d-8.dat family_danabot task2/files/0x000100000001b00d-9.dat family_danabot - Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4292 4228 regsvr32.exe 76 - Blocklisted process makes network request 3 IoCs
flow pid Process 13 3096 rundll32.exe 16 3096 rundll32.exe 17 3096 rundll32.exe - Sets DLL path for service in the registry 2 TTPs
- Sets service image path in registry 2 TTPs
- Loads dropped DLL 6 IoCs
pid Process 4356 regsvr32.exe 3096 rundll32.exe 4892 rundll32.exe 5112 rundll32.exe 5056 rundll32.exe 452 RUNDLL32.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4928 WScript.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4292 wrote to memory of 4356 4292 regsvr32.exe 78 PID 4292 wrote to memory of 4356 4292 regsvr32.exe 78 PID 4292 wrote to memory of 4356 4292 regsvr32.exe 78 PID 4356 wrote to memory of 3096 4356 regsvr32.exe 81 PID 4356 wrote to memory of 3096 4356 regsvr32.exe 81 PID 4356 wrote to memory of 3096 4356 regsvr32.exe 81 PID 3096 wrote to memory of 4892 3096 rundll32.exe 90 PID 3096 wrote to memory of 4892 3096 rundll32.exe 90 PID 3096 wrote to memory of 4892 3096 rundll32.exe 90 PID 4892 wrote to memory of 5112 4892 rundll32.exe 91 PID 4892 wrote to memory of 5112 4892 rundll32.exe 91 PID 5112 wrote to memory of 5056 5112 rundll32.exe 92 PID 5112 wrote to memory of 5056 5112 rundll32.exe 92 PID 5112 wrote to memory of 5056 5112 rundll32.exe 92 PID 5112 wrote to memory of 452 5112 rundll32.exe 93 PID 5112 wrote to memory of 452 5112 rundll32.exe 93
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\AXO23516563548321.vbs"1⤵
- Suspicious use of FindShellTrayWindow
PID:4928
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\PdK.txt1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\PdK.txt2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\PdK.txt,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\\rundll32.exe C:\PROGRA~3\2E7D293B\83826127.dll,f1 C:\Users\Admin\AppData\Local\Temp\PdK.txt@30964⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\system32\rundll32.exeC:\Windows\system32\\rundll32.exe C:\PROGRA~3\2E7D293B\83826127.dll,f1 C:\Users\Admin\AppData\Local\Temp\PdK.txt@30965⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\syswow64\rundll32.exeC:\Windows\syswow64\rundll32.exe C:\ProgramData\2E7D293B\7FF3A822.dll,f2 4458A332E9B82FF56A9D22C7A5CF0F746⤵
- Loads dropped DLL
PID:5056
-
-
C:\Windows\system32\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\ProgramData\2E7D293B\83826127.dll,f2 72D316C1CAD6D793C258DF23A1B240906⤵
- Loads dropped DLL
PID:452
-
-
-
-
-