Analysis
-
max time kernel
120s -
max time network
74s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
24-06-2020 14:54
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe
Resource
win7v200430
General
-
Target
SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe
-
Size
2.6MB
-
MD5
3aca8b56716ae3d03be877b9dd4729a6
-
SHA1
fc0a13a5f18cb1b81a5ea67533a366ffceeda02b
-
SHA256
a31934ff6fce423c793ab9d1e4bd4067986033e552ba36a7ea360dec57b83dd2
-
SHA512
dfc89beca5485f96fa469b6985c69f402d5ca802a51e3218b862925cea747815642bdfcd899911d9542e38ee76483ce068a884164627403d150b7a21b3132117
Malware Config
Extracted
danabot
92.204.160.126
193.34.166.26
93.115.22.159
93.115.22.165
185.227.138.52
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot -
Blocklisted process makes network request 10 IoCs
Processes:
rundll32.exeflow pid process 2 1864 rundll32.exe 3 1864 rundll32.exe 4 1864 rundll32.exe 5 1864 rundll32.exe 6 1864 rundll32.exe 7 1864 rundll32.exe 8 1864 rundll32.exe 9 1864 rundll32.exe 10 1864 rundll32.exe 11 1864 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 1836 regsvr32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exeregsvr32.exedescription pid process target process PID 480 wrote to memory of 1836 480 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe regsvr32.exe PID 480 wrote to memory of 1836 480 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe regsvr32.exe PID 480 wrote to memory of 1836 480 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe regsvr32.exe PID 480 wrote to memory of 1836 480 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe regsvr32.exe PID 480 wrote to memory of 1836 480 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe regsvr32.exe PID 480 wrote to memory of 1836 480 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe regsvr32.exe PID 480 wrote to memory of 1836 480 SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe regsvr32.exe PID 1836 wrote to memory of 1864 1836 regsvr32.exe rundll32.exe PID 1836 wrote to memory of 1864 1836 regsvr32.exe rundll32.exe PID 1836 wrote to memory of 1864 1836 regsvr32.exe rundll32.exe PID 1836 wrote to memory of 1864 1836 regsvr32.exe rundll32.exe PID 1836 wrote to memory of 1864 1836 regsvr32.exe rundll32.exe PID 1836 wrote to memory of 1864 1836 regsvr32.exe rundll32.exe PID 1836 wrote to memory of 1864 1836 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.vc.31846.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@4802⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
memory/480-0-0x0000000005030000-0x00000000052A7000-memory.dmpFilesize
2.5MB
-
memory/480-1-0x00000000052B0000-0x00000000052C1000-memory.dmpFilesize
68KB
-
memory/1836-2-0x0000000000000000-mapping.dmp
-
memory/1864-5-0x0000000000000000-mapping.dmp