Analysis
-
max time kernel
133s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-11-2020 10:46
Static task
static1
Behavioral task
behavioral1
Sample
siri_active_1.exe
Resource
win7v20201028
General
-
Target
siri_active_1.exe
-
Size
2.6MB
-
MD5
45c235992028091065c4a3be6d409296
-
SHA1
c142417f014c9b2d28e7b6492de4ca6b3102ba26
-
SHA256
00d10f9ac567b10c0ffd80fdd6f493cac120ab3cd2aa3ce58d05bfd73b4d11fb
-
SHA512
c15575b32dce3707770d663aa5e797ccd10a5571369597c400bc09ede4dd14a33013dfcd8f652516394b2faef264a7dc48eb848a04cbf96313cfea14e656088f
Malware Config
Extracted
danabot
92.204.160.126
193.34.166.26
93.115.22.159
93.115.22.165
185.227.138.52
Signatures
-
Danabot x86 payload 4 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2812 created 412 2812 WerFault.exe siri_active_1.exe -
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 9 204 rundll32.exe 16 204 rundll32.exe 17 204 rundll32.exe 18 204 rundll32.exe 19 204 rundll32.exe 20 204 rundll32.exe 21 204 rundll32.exe -
Loads dropped DLL 3 IoCs
Processes:
regsvr32.exerundll32.exepid process 3228 regsvr32.exe 3228 regsvr32.exe 204 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2812 412 WerFault.exe siri_active_1.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 2812 WerFault.exe 2812 WerFault.exe 2812 WerFault.exe 2812 WerFault.exe 2812 WerFault.exe 2812 WerFault.exe 2812 WerFault.exe 2812 WerFault.exe 2812 WerFault.exe 2812 WerFault.exe 2812 WerFault.exe 2812 WerFault.exe 2812 WerFault.exe 2812 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2812 WerFault.exe Token: SeBackupPrivilege 2812 WerFault.exe Token: SeDebugPrivilege 2812 WerFault.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
siri_active_1.exeregsvr32.exedescription pid process target process PID 412 wrote to memory of 3228 412 siri_active_1.exe regsvr32.exe PID 412 wrote to memory of 3228 412 siri_active_1.exe regsvr32.exe PID 412 wrote to memory of 3228 412 siri_active_1.exe regsvr32.exe PID 3228 wrote to memory of 204 3228 regsvr32.exe rundll32.exe PID 3228 wrote to memory of 204 3228 regsvr32.exe rundll32.exe PID 3228 wrote to memory of 204 3228 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\siri_active_1.exe"C:\Users\Admin\AppData\Local\Temp\siri_active_1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.EXE@4122⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 1402⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
memory/204-9-0x0000000000000000-mapping.dmp
-
memory/412-1-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/2812-3-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/2812-4-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/2812-11-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/3228-2-0x0000000000000000-mapping.dmp