Analysis
-
max time kernel
72s -
max time network
81s -
platform
windows7_x64 -
resource
win7 -
submitted
24-06-2020 14:54
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BehavesLike.Win32.Generic.vc.524.exe
Resource
win7
General
-
Target
SecuriteInfo.com.BehavesLike.Win32.Generic.vc.524.exe
-
Size
2.6MB
-
MD5
a3c5fbba1743945b3d9b6d8c8958dbda
-
SHA1
d01ab833f9223c05735961b0964871536d18daba
-
SHA256
66b20857c01e98b2e07c7c60eb7661689f303fb975f085bba45ab453b0b355ca
-
SHA512
c1dd61909eeb9ce6b9ce406227cc0109bbe39a46b43784210b720d922cf4893113bc56d1883c423e49d1dda4d20cf75af8036f025550f6a89cd3e817ea6f7ada
Malware Config
Extracted
danabot
92.204.160.126
193.34.166.26
93.115.22.159
93.115.22.165
185.227.138.52
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot -
Blocklisted process makes network request 10 IoCs
Processes:
rundll32.exeflow pid process 1 364 rundll32.exe 2 364 rundll32.exe 5 364 rundll32.exe 6 364 rundll32.exe 7 364 rundll32.exe 8 364 rundll32.exe 10 364 rundll32.exe 11 364 rundll32.exe 12 364 rundll32.exe 13 364 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 776 regsvr32.exe 364 rundll32.exe 364 rundll32.exe 364 rundll32.exe 364 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.vc.524.exeregsvr32.exedescription pid process target process PID 672 wrote to memory of 776 672 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.524.exe regsvr32.exe PID 672 wrote to memory of 776 672 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.524.exe regsvr32.exe PID 672 wrote to memory of 776 672 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.524.exe regsvr32.exe PID 672 wrote to memory of 776 672 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.524.exe regsvr32.exe PID 672 wrote to memory of 776 672 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.524.exe regsvr32.exe PID 672 wrote to memory of 776 672 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.524.exe regsvr32.exe PID 672 wrote to memory of 776 672 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.524.exe regsvr32.exe PID 776 wrote to memory of 364 776 regsvr32.exe rundll32.exe PID 776 wrote to memory of 364 776 regsvr32.exe rundll32.exe PID 776 wrote to memory of 364 776 regsvr32.exe rundll32.exe PID 776 wrote to memory of 364 776 regsvr32.exe rundll32.exe PID 776 wrote to memory of 364 776 regsvr32.exe rundll32.exe PID 776 wrote to memory of 364 776 regsvr32.exe rundll32.exe PID 776 wrote to memory of 364 776 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.vc.524.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.vc.524.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@6722⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
memory/364-5-0x0000000000000000-mapping.dmp
-
memory/672-0-0x0000000004EC0000-0x0000000005137000-memory.dmpFilesize
2.5MB
-
memory/672-1-0x0000000005140000-0x0000000005151000-memory.dmpFilesize
68KB
-
memory/776-2-0x0000000000000000-mapping.dmp