Analysis
-
max time kernel
132s -
max time network
138s -
platform
windows7_x64 -
resource
win7 -
submitted
24-06-2020 14:54
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Generic.mg.fd03fccdce84ae08.12016.exe
Resource
win7
General
-
Target
SecuriteInfo.com.Generic.mg.fd03fccdce84ae08.12016.exe
-
Size
2.6MB
-
MD5
fd03fccdce84ae08518761609f524f78
-
SHA1
0a288baeca49b834de50cb1f5b02a967818b8248
-
SHA256
57d5d3c20111dcdb68165ce1b0189bd2f4256584642266f9f1f4ed000096e976
-
SHA512
d91b646c6bab1add593ada5be488b58f37e21bb54969ec5c38227a92a3f37b5f2ce93de923cc9bb93a79758a435c4315c17ed2f67f5534eb82cd05a36b696950
Malware Config
Extracted
danabot
92.204.160.126
193.34.166.26
93.115.22.159
93.115.22.165
185.227.138.52
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot -
Blocklisted process makes network request 10 IoCs
Processes:
rundll32.exeflow pid process 4 284 rundll32.exe 5 284 rundll32.exe 6 284 rundll32.exe 7 284 rundll32.exe 8 284 rundll32.exe 9 284 rundll32.exe 10 284 rundll32.exe 11 284 rundll32.exe 12 284 rundll32.exe 13 284 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 912 regsvr32.exe 284 rundll32.exe 284 rundll32.exe 284 rundll32.exe 284 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
SecuriteInfo.com.Generic.mg.fd03fccdce84ae08.12016.exeregsvr32.exedescription pid process target process PID 1448 wrote to memory of 912 1448 SecuriteInfo.com.Generic.mg.fd03fccdce84ae08.12016.exe regsvr32.exe PID 1448 wrote to memory of 912 1448 SecuriteInfo.com.Generic.mg.fd03fccdce84ae08.12016.exe regsvr32.exe PID 1448 wrote to memory of 912 1448 SecuriteInfo.com.Generic.mg.fd03fccdce84ae08.12016.exe regsvr32.exe PID 1448 wrote to memory of 912 1448 SecuriteInfo.com.Generic.mg.fd03fccdce84ae08.12016.exe regsvr32.exe PID 1448 wrote to memory of 912 1448 SecuriteInfo.com.Generic.mg.fd03fccdce84ae08.12016.exe regsvr32.exe PID 1448 wrote to memory of 912 1448 SecuriteInfo.com.Generic.mg.fd03fccdce84ae08.12016.exe regsvr32.exe PID 1448 wrote to memory of 912 1448 SecuriteInfo.com.Generic.mg.fd03fccdce84ae08.12016.exe regsvr32.exe PID 912 wrote to memory of 284 912 regsvr32.exe rundll32.exe PID 912 wrote to memory of 284 912 regsvr32.exe rundll32.exe PID 912 wrote to memory of 284 912 regsvr32.exe rundll32.exe PID 912 wrote to memory of 284 912 regsvr32.exe rundll32.exe PID 912 wrote to memory of 284 912 regsvr32.exe rundll32.exe PID 912 wrote to memory of 284 912 regsvr32.exe rundll32.exe PID 912 wrote to memory of 284 912 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.fd03fccdce84ae08.12016.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.fd03fccdce84ae08.12016.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@14482⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
memory/284-5-0x0000000000000000-mapping.dmp
-
memory/912-2-0x0000000000000000-mapping.dmp
-
memory/1448-0-0x0000000004E10000-0x0000000005087000-memory.dmpFilesize
2.5MB
-
memory/1448-1-0x0000000005090000-0x00000000050A1000-memory.dmpFilesize
68KB