Analysis
-
max time kernel
134s -
max time network
142s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:38
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729.exe
Resource
win7v20201028
General
-
Target
SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729.exe
-
Size
940KB
-
MD5
90ed97fd14801fceaca28bf9e2ccb646
-
SHA1
df8ed59f466cbe150e51924385f4151dace21283
-
SHA256
5bc7a56b2dcc47933032f0ebde41aae2f6792e90c8a012a90ffc4ad824ee0abd
-
SHA512
91539dc7c9aa4b1983060cd50803de0dda958872940209e8003f767cb929772e591fc71e5a9c3ab967ebf4745af15b26b7e1c6a06ed76fb65be24767fe86675c
Malware Config
Extracted
danabot
54.38.22.65
192.99.219.207
51.255.134.130
192.236.179.73
23.82.140.201
172.81.129.196
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot -
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 2 1284 rundll32.exe 5 1284 rundll32.exe 6 1284 rundll32.exe 9 1284 rundll32.exe 12 1284 rundll32.exe 13 1284 rundll32.exe 14 1284 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 2032 regsvr32.exe 1284 rundll32.exe 1284 rundll32.exe 1284 rundll32.exe 1284 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729.exeregsvr32.exedescription pid process target process PID 868 wrote to memory of 2032 868 SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729.exe regsvr32.exe PID 868 wrote to memory of 2032 868 SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729.exe regsvr32.exe PID 868 wrote to memory of 2032 868 SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729.exe regsvr32.exe PID 868 wrote to memory of 2032 868 SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729.exe regsvr32.exe PID 868 wrote to memory of 2032 868 SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729.exe regsvr32.exe PID 868 wrote to memory of 2032 868 SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729.exe regsvr32.exe PID 868 wrote to memory of 2032 868 SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729.exe regsvr32.exe PID 2032 wrote to memory of 1284 2032 regsvr32.exe rundll32.exe PID 2032 wrote to memory of 1284 2032 regsvr32.exe rundll32.exe PID 2032 wrote to memory of 1284 2032 regsvr32.exe rundll32.exe PID 2032 wrote to memory of 1284 2032 regsvr32.exe rundll32.exe PID 2032 wrote to memory of 1284 2032 regsvr32.exe rundll32.exe PID 2032 wrote to memory of 1284 2032 regsvr32.exe rundll32.exe PID 2032 wrote to memory of 1284 2032 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@8682⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
fad1a4c4c3d3ab75073c36c0d3cf5f6c
SHA1c34d0a6389836324bc7da05005fc2d1662652ed4
SHA256b9e5e0ed132588b526d75fd6630fea77d4454cfc30404bfbd32a8dd526df8cd0
SHA512980e09eb444d12f153a07d2f1274be929f8999238147a0e512b9abcb4f7005e0950356560c340e7b5d5775c2f7e29d10344dfb15d76fca9943a7beae5f373429
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
fad1a4c4c3d3ab75073c36c0d3cf5f6c
SHA1c34d0a6389836324bc7da05005fc2d1662652ed4
SHA256b9e5e0ed132588b526d75fd6630fea77d4454cfc30404bfbd32a8dd526df8cd0
SHA512980e09eb444d12f153a07d2f1274be929f8999238147a0e512b9abcb4f7005e0950356560c340e7b5d5775c2f7e29d10344dfb15d76fca9943a7beae5f373429
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
fad1a4c4c3d3ab75073c36c0d3cf5f6c
SHA1c34d0a6389836324bc7da05005fc2d1662652ed4
SHA256b9e5e0ed132588b526d75fd6630fea77d4454cfc30404bfbd32a8dd526df8cd0
SHA512980e09eb444d12f153a07d2f1274be929f8999238147a0e512b9abcb4f7005e0950356560c340e7b5d5775c2f7e29d10344dfb15d76fca9943a7beae5f373429
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
fad1a4c4c3d3ab75073c36c0d3cf5f6c
SHA1c34d0a6389836324bc7da05005fc2d1662652ed4
SHA256b9e5e0ed132588b526d75fd6630fea77d4454cfc30404bfbd32a8dd526df8cd0
SHA512980e09eb444d12f153a07d2f1274be929f8999238147a0e512b9abcb4f7005e0950356560c340e7b5d5775c2f7e29d10344dfb15d76fca9943a7beae5f373429
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
fad1a4c4c3d3ab75073c36c0d3cf5f6c
SHA1c34d0a6389836324bc7da05005fc2d1662652ed4
SHA256b9e5e0ed132588b526d75fd6630fea77d4454cfc30404bfbd32a8dd526df8cd0
SHA512980e09eb444d12f153a07d2f1274be929f8999238147a0e512b9abcb4f7005e0950356560c340e7b5d5775c2f7e29d10344dfb15d76fca9943a7beae5f373429
-
\Users\Admin\AppData\Local\Temp\SECURI~1.DLLMD5
fad1a4c4c3d3ab75073c36c0d3cf5f6c
SHA1c34d0a6389836324bc7da05005fc2d1662652ed4
SHA256b9e5e0ed132588b526d75fd6630fea77d4454cfc30404bfbd32a8dd526df8cd0
SHA512980e09eb444d12f153a07d2f1274be929f8999238147a0e512b9abcb4f7005e0950356560c340e7b5d5775c2f7e29d10344dfb15d76fca9943a7beae5f373429
-
memory/1284-3-0x0000000000000000-mapping.dmp
-
memory/2032-0-0x0000000000000000-mapping.dmp