Analysis
-
max time kernel
135s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
16-11-2020 15:49
Static task
static1
Behavioral task
behavioral1
Sample
siri_api_connect_0.exe
Resource
win7v20201028
General
-
Target
siri_api_connect_0.exe
-
Size
2.6MB
-
MD5
45c235992028091065c4a3be6d409296
-
SHA1
c142417f014c9b2d28e7b6492de4ca6b3102ba26
-
SHA256
00d10f9ac567b10c0ffd80fdd6f493cac120ab3cd2aa3ce58d05bfd73b4d11fb
-
SHA512
c15575b32dce3707770d663aa5e797ccd10a5571369597c400bc09ede4dd14a33013dfcd8f652516394b2faef264a7dc48eb848a04cbf96313cfea14e656088f
Malware Config
Extracted
danabot
92.204.160.126
193.34.166.26
93.115.22.159
93.115.22.165
185.227.138.52
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot -
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 3 1240 rundll32.exe 6 1240 rundll32.exe 7 1240 rundll32.exe 8 1240 rundll32.exe 9 1240 rundll32.exe 10 1240 rundll32.exe 11 1240 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 1908 regsvr32.exe 1240 rundll32.exe 1240 rundll32.exe 1240 rundll32.exe 1240 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
siri_api_connect_0.exeregsvr32.exedescription pid process target process PID 364 wrote to memory of 1908 364 siri_api_connect_0.exe regsvr32.exe PID 364 wrote to memory of 1908 364 siri_api_connect_0.exe regsvr32.exe PID 364 wrote to memory of 1908 364 siri_api_connect_0.exe regsvr32.exe PID 364 wrote to memory of 1908 364 siri_api_connect_0.exe regsvr32.exe PID 364 wrote to memory of 1908 364 siri_api_connect_0.exe regsvr32.exe PID 364 wrote to memory of 1908 364 siri_api_connect_0.exe regsvr32.exe PID 364 wrote to memory of 1908 364 siri_api_connect_0.exe regsvr32.exe PID 1908 wrote to memory of 1240 1908 regsvr32.exe rundll32.exe PID 1908 wrote to memory of 1240 1908 regsvr32.exe rundll32.exe PID 1908 wrote to memory of 1240 1908 regsvr32.exe rundll32.exe PID 1908 wrote to memory of 1240 1908 regsvr32.exe rundll32.exe PID 1908 wrote to memory of 1240 1908 regsvr32.exe rundll32.exe PID 1908 wrote to memory of 1240 1908 regsvr32.exe rundll32.exe PID 1908 wrote to memory of 1240 1908 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\siri_api_connect_0.exe"C:\Users\Admin\AppData\Local\Temp\siri_api_connect_0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.EXE@3642⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
17a152a9c199508bc77e67f0dcacf6b9
SHA1dffb7313156364818b857ed1e7837222007dd389
SHA256affc44017d528d13e26e76da27ab36da940cd26c5ebe30ca0c5531d543c7a92f
SHA51264c139f36d25efd99354b30288e504dc5a9376666d1a63ccf1779e0e312e55b2b2c31c804e3d88d25311342df0156e616c67d7b843c07f673272410f442022dc
-
memory/364-0-0x0000000004E90000-0x0000000005107000-memory.dmpFilesize
2.5MB
-
memory/364-1-0x0000000005110000-0x0000000005121000-memory.dmpFilesize
68KB
-
memory/1240-5-0x0000000000000000-mapping.dmp
-
memory/1908-2-0x0000000000000000-mapping.dmp