Analysis
-
max time kernel
117s -
max time network
112s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
24-06-2020 14:54
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BehavesLike.Win32.Generic.vc.298.exe
Resource
win7v200430
General
-
Target
SecuriteInfo.com.BehavesLike.Win32.Generic.vc.298.exe
-
Size
2.6MB
-
MD5
4302d6701fb63bcedfa03978e71df2a8
-
SHA1
8495e73f641e50a7a8bbe6208dc3cbbfc9617b87
-
SHA256
fe2d28e32b08fafd6fd9e6be8920466191ab596a89b06391f7c178574d138e77
-
SHA512
c6afb79d0d6864f533ceab99b7bd60e9a7b66ea01f8fc4174a6af27015b9fde08832c9ac2318138d664b8660a3bdfbd606574c0ecc3eeaa65fb542e0df55a37c
Malware Config
Extracted
danabot
92.204.160.126
193.34.166.26
93.115.22.159
93.115.22.165
185.227.138.52
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot -
Blocklisted process makes network request 10 IoCs
Processes:
rundll32.exeflow pid process 3 1808 rundll32.exe 4 1808 rundll32.exe 5 1808 rundll32.exe 6 1808 rundll32.exe 7 1808 rundll32.exe 8 1808 rundll32.exe 11 1808 rundll32.exe 12 1808 rundll32.exe 13 1808 rundll32.exe 14 1808 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 1828 regsvr32.exe 1808 rundll32.exe 1808 rundll32.exe 1808 rundll32.exe 1808 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.vc.298.exeregsvr32.exedescription pid process target process PID 1016 wrote to memory of 1828 1016 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.298.exe regsvr32.exe PID 1016 wrote to memory of 1828 1016 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.298.exe regsvr32.exe PID 1016 wrote to memory of 1828 1016 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.298.exe regsvr32.exe PID 1016 wrote to memory of 1828 1016 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.298.exe regsvr32.exe PID 1016 wrote to memory of 1828 1016 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.298.exe regsvr32.exe PID 1016 wrote to memory of 1828 1016 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.298.exe regsvr32.exe PID 1016 wrote to memory of 1828 1016 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.298.exe regsvr32.exe PID 1828 wrote to memory of 1808 1828 regsvr32.exe rundll32.exe PID 1828 wrote to memory of 1808 1828 regsvr32.exe rundll32.exe PID 1828 wrote to memory of 1808 1828 regsvr32.exe rundll32.exe PID 1828 wrote to memory of 1808 1828 regsvr32.exe rundll32.exe PID 1828 wrote to memory of 1808 1828 regsvr32.exe rundll32.exe PID 1828 wrote to memory of 1808 1828 regsvr32.exe rundll32.exe PID 1828 wrote to memory of 1808 1828 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.vc.298.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.vc.298.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@10162⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
memory/1016-0-0x0000000004F70000-0x00000000051E7000-memory.dmpFilesize
2.5MB
-
memory/1016-1-0x00000000051F0000-0x0000000005201000-memory.dmpFilesize
68KB
-
memory/1808-5-0x0000000000000000-mapping.dmp
-
memory/1828-2-0x0000000000000000-mapping.dmp