Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
16-11-2020 15:49
Static task
static1
Behavioral task
behavioral1
Sample
siri_api_connect_0.exe
Resource
win7v20201028
General
-
Target
siri_api_connect_0.exe
-
Size
2.6MB
-
MD5
45c235992028091065c4a3be6d409296
-
SHA1
c142417f014c9b2d28e7b6492de4ca6b3102ba26
-
SHA256
00d10f9ac567b10c0ffd80fdd6f493cac120ab3cd2aa3ce58d05bfd73b4d11fb
-
SHA512
c15575b32dce3707770d663aa5e797ccd10a5571369597c400bc09ede4dd14a33013dfcd8f652516394b2faef264a7dc48eb848a04cbf96313cfea14e656088f
Malware Config
Extracted
danabot
92.204.160.126
193.34.166.26
93.115.22.159
93.115.22.165
185.227.138.52
Signatures
-
Danabot x86 payload 4 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL family_danabot -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 3492 created 3160 3492 WerFault.exe siri_api_connect_0.exe -
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 10 2464 rundll32.exe 16 2464 rundll32.exe 17 2464 rundll32.exe 18 2464 rundll32.exe 19 2464 rundll32.exe 21 2464 rundll32.exe 22 2464 rundll32.exe -
Loads dropped DLL 3 IoCs
Processes:
regsvr32.exerundll32.exepid process 2864 regsvr32.exe 2864 regsvr32.exe 2464 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3492 3160 WerFault.exe siri_api_connect_0.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe 3492 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3492 WerFault.exe Token: SeBackupPrivilege 3492 WerFault.exe Token: SeDebugPrivilege 3492 WerFault.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
siri_api_connect_0.exeregsvr32.exedescription pid process target process PID 3160 wrote to memory of 2864 3160 siri_api_connect_0.exe regsvr32.exe PID 3160 wrote to memory of 2864 3160 siri_api_connect_0.exe regsvr32.exe PID 3160 wrote to memory of 2864 3160 siri_api_connect_0.exe regsvr32.exe PID 2864 wrote to memory of 2464 2864 regsvr32.exe rundll32.exe PID 2864 wrote to memory of 2464 2864 regsvr32.exe rundll32.exe PID 2864 wrote to memory of 2464 2864 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\siri_api_connect_0.exe"C:\Users\Admin\AppData\Local\Temp\siri_api_connect_0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.EXE@31602⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1442⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
\Users\Admin\AppData\Local\Temp\SIRI_A~1.DLLMD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
memory/2464-9-0x0000000000000000-mapping.dmp
-
memory/2864-2-0x0000000000000000-mapping.dmp
-
memory/3160-1-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/3492-6-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/3492-7-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/3492-12-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB