danabot | d6b7cb431b16723bce5523e0ac0c99fe0e583afaf1154f51cffee7420fe4dd74

Analysis

max time kernel
123s
max time network
120s
platform
windows7_x64
resource
win7v20210410
submitted
21-04-2021 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vpn.bin.exe
Size

1.1MB
MD5

5a4f537ffd75be93484d34543127898c
SHA1

3b70254cce9cfcae221637c00610c6a7543f0272
SHA256

d6b7cb431b16723bce5523e0ac0c99fe0e583afaf1154f51cffee7420fe4dd74
SHA512

871b2c0ab547ac8e8dd38f6500fd59a190cc04f53282a2eee77641d2e5139c9788aa40cd9dc4ae8bccfc2be04fadb7ce20f3f36592b660a404d93972d90c1a87

Score

10^/10

danabot 3 banker discovery spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1827

Botnet

23.106.123.185:443

192.210.198.12:443

192.236.147.83:443

23.106.123.141:443

Attributes

embedded_hash
AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 9 IoCs

Processes:

RUNDLL32.EXEWScript.exe

flow	pid	process
18	1064	RUNDLL32.EXE
21	2004	WScript.exe
23	2004	WScript.exe
25	2004	WScript.exe
27	2004	WScript.exe
29	2004	WScript.exe
30	1064	RUNDLL32.EXE
33	1064	RUNDLL32.EXE
34	1064	RUNDLL32.EXE

Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

Trascinava.exe.comTrascinava.exe.comccigkhwuyec.exe

pid process

432 Trascinava.exe.com
932 Trascinava.exe.com
388 ccigkhwuyec.exe

pid	process
432	Trascinava.exe.com
932	Trascinava.exe.com
388	ccigkhwuyec.exe

Loads dropped DLL 11 IoCs

Processes:

cmd.exeTrascinava.exe.comrundll32.exeRUNDLL32.EXE

pid	process
1840	cmd.exe
932	Trascinava.exe.com
932	Trascinava.exe.com
368	rundll32.exe
368	rundll32.exe
368	rundll32.exe
368	rundll32.exe
1064	RUNDLL32.EXE
1064	RUNDLL32.EXE
1064	RUNDLL32.EXE
1064	RUNDLL32.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 6 IoCs

Processes:

RUNDLL32.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AJ1NIV9I\desktop.ini	RUNDLL32.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VLFEZDK1\desktop.ini	RUNDLL32.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQE06QBJ\desktop.ini	RUNDLL32.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	RUNDLL32.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\93PHUZFG\desktop.ini	RUNDLL32.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	RUNDLL32.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
7	ip-api.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Trascinava.exe.com

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Trascinava.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Trascinava.exe.com

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Trascinava.exe.comWScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Trascinava.exe.com
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Trascinava.exe.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	WScript.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

268 PING.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

rundll32.exeRUNDLL32.EXE

description pid process

Token: SeDebugPrivilege 368 rundll32.exe
Token: SeDebugPrivilege 1064 RUNDLL32.EXE

pid	process
268	PING.EXE

description	pid	process
Token: SeDebugPrivilege	368	rundll32.exe
Token: SeDebugPrivilege	1064	RUNDLL32.EXE

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

vpn.bin.execmd.execmd.exeTrascinava.exe.comTrascinava.exe.comccigkhwuyec.exerundll32.exe

description	pid	process	target process
PID 1076 wrote to memory of 1280	1076	vpn.bin.exe	makecab.exe
PID 1076 wrote to memory of 1280	1076	vpn.bin.exe	makecab.exe
PID 1076 wrote to memory of 1280	1076	vpn.bin.exe	makecab.exe
PID 1076 wrote to memory of 1280	1076	vpn.bin.exe	makecab.exe
PID 1076 wrote to memory of 1960	1076	vpn.bin.exe	cmd.exe
PID 1076 wrote to memory of 1960	1076	vpn.bin.exe	cmd.exe
PID 1076 wrote to memory of 1960	1076	vpn.bin.exe	cmd.exe
PID 1076 wrote to memory of 1960	1076	vpn.bin.exe	cmd.exe
PID 1960 wrote to memory of 1840	1960	cmd.exe	cmd.exe
PID 1960 wrote to memory of 1840	1960	cmd.exe	cmd.exe
PID 1960 wrote to memory of 1840	1960	cmd.exe	cmd.exe
PID 1960 wrote to memory of 1840	1960	cmd.exe	cmd.exe
PID 1840 wrote to memory of 1616	1840	cmd.exe	findstr.exe
PID 1840 wrote to memory of 1616	1840	cmd.exe	findstr.exe
PID 1840 wrote to memory of 1616	1840	cmd.exe	findstr.exe
PID 1840 wrote to memory of 1616	1840	cmd.exe	findstr.exe
PID 1840 wrote to memory of 432	1840	cmd.exe	Trascinava.exe.com
PID 1840 wrote to memory of 432	1840	cmd.exe	Trascinava.exe.com
PID 1840 wrote to memory of 432	1840	cmd.exe	Trascinava.exe.com
PID 1840 wrote to memory of 432	1840	cmd.exe	Trascinava.exe.com
PID 1840 wrote to memory of 268	1840	cmd.exe	PING.EXE
PID 1840 wrote to memory of 268	1840	cmd.exe	PING.EXE
PID 1840 wrote to memory of 268	1840	cmd.exe	PING.EXE
PID 1840 wrote to memory of 268	1840	cmd.exe	PING.EXE
PID 432 wrote to memory of 932	432	Trascinava.exe.com	Trascinava.exe.com
PID 432 wrote to memory of 932	432	Trascinava.exe.com	Trascinava.exe.com
PID 432 wrote to memory of 932	432	Trascinava.exe.com	Trascinava.exe.com
PID 432 wrote to memory of 932	432	Trascinava.exe.com	Trascinava.exe.com
PID 932 wrote to memory of 388	932	Trascinava.exe.com	ccigkhwuyec.exe
PID 932 wrote to memory of 388	932	Trascinava.exe.com	ccigkhwuyec.exe
PID 932 wrote to memory of 388	932	Trascinava.exe.com	ccigkhwuyec.exe
PID 932 wrote to memory of 388	932	Trascinava.exe.com	ccigkhwuyec.exe
PID 932 wrote to memory of 1156	932	Trascinava.exe.com	WScript.exe
PID 932 wrote to memory of 1156	932	Trascinava.exe.com	WScript.exe
PID 932 wrote to memory of 1156	932	Trascinava.exe.com	WScript.exe
PID 932 wrote to memory of 1156	932	Trascinava.exe.com	WScript.exe
PID 388 wrote to memory of 368	388	ccigkhwuyec.exe	rundll32.exe
PID 388 wrote to memory of 368	388	ccigkhwuyec.exe	rundll32.exe
PID 388 wrote to memory of 368	388	ccigkhwuyec.exe	rundll32.exe
PID 388 wrote to memory of 368	388	ccigkhwuyec.exe	rundll32.exe
PID 388 wrote to memory of 368	388	ccigkhwuyec.exe	rundll32.exe
PID 388 wrote to memory of 368	388	ccigkhwuyec.exe	rundll32.exe
PID 388 wrote to memory of 368	388	ccigkhwuyec.exe	rundll32.exe
PID 368 wrote to memory of 1064	368	rundll32.exe	RUNDLL32.EXE
PID 368 wrote to memory of 1064	368	rundll32.exe	RUNDLL32.EXE
PID 368 wrote to memory of 1064	368	rundll32.exe	RUNDLL32.EXE
PID 368 wrote to memory of 1064	368	rundll32.exe	RUNDLL32.EXE
PID 368 wrote to memory of 1064	368	rundll32.exe	RUNDLL32.EXE
PID 368 wrote to memory of 1064	368	rundll32.exe	RUNDLL32.EXE
PID 368 wrote to memory of 1064	368	rundll32.exe	RUNDLL32.EXE
PID 932 wrote to memory of 2004	932	Trascinava.exe.com	WScript.exe
PID 932 wrote to memory of 2004	932	Trascinava.exe.com	WScript.exe
PID 932 wrote to memory of 2004	932	Trascinava.exe.com	WScript.exe
PID 932 wrote to memory of 2004	932	Trascinava.exe.com	WScript.exe

C:\Users\Admin\AppData\Local\Temp\vpn.bin.exe
"C:\Users\Admin\AppData\Local\Temp\vpn.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\makecab.exe
"C:\Windows\System32\makecab.exe"
2⤵
PID:1280

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c RlFBBTBnWWwxXYwFINyxjFlP & APjAehxPNGRyRlxhFSeDuKfwKH & cmd < Aprile.msi
2⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\cmd.exe
cmd
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^gPIKOQDiOVOQAkxOJpjaiBEhzvnzmHdsLNWlyPxotLIoNpJmItLcVfDMkcdsalIiEvtNgpITPtgcTcmlNYKxWUvvplZJnePUrBDdyWkmcRGRwoSQWuDxmhlJqIDtlZcMg$" Tese.msi
4⤵
PID:1616

C:\Users\Admin\AppData\Roaming\ieBjZPIwrfYTIGFlspmRCLiHMokMPmlPcKhNkxSfoosYGYzWBAYSlPqvVTmQDWkDtonXzSYWslJxzoqNPfkfBaFF\Trascinava.exe.com
Trascinava.exe.com Y
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432

C:\Users\Admin\AppData\Roaming\ieBjZPIwrfYTIGFlspmRCLiHMokMPmlPcKhNkxSfoosYGYzWBAYSlPqvVTmQDWkDtonXzSYWslJxzoqNPfkfBaFF\Trascinava.exe.com
C:\Users\Admin\AppData\Roaming\ieBjZPIwrfYTIGFlspmRCLiHMokMPmlPcKhNkxSfoosYGYzWBAYSlPqvVTmQDWkDtonXzSYWslJxzoqNPfkfBaFF\Trascinava.exe.com Y
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:932

C:\Users\Admin\AppData\Local\Temp\ccigkhwuyec.exe
"C:\Users\Admin\AppData\Local\Temp\ccigkhwuyec.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\CCIGKH~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\CCIGKH~1.EXE
7⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\CCIGKH~1.DLL,Iw0WjBwlA0D3
8⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\peeqdwg.vbs"
6⤵
PID:1156

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\broyolx.vbs"
6⤵
- Blocklisted process makes network request
- Modifies system certificate store
PID:2004

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
4⤵
- Runs ping.exe
PID:268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
e9bf60114e4088af4694926379b91f91

SHA1
50bf9771f607caf52270ce7c9c4a42f9f830d838

SHA256
75022e5bf09ee5b58610c1f284bc05ffa4def4fb5f643d90314532933124c7b1

SHA512
f56fe2cf7d41b591e08d4aace5c26291690c710be0c88ec8328128e6ef903abbd339a3da4cd2f4a5b58bcb7114751cbf923d42b2c96c157bcc91568f965516c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G2KS51P3\json[1].json
MD5
149c2823b7eadbfb0a82388a2ab9494f

SHA1
415fe979ce5fd0064d2557a48745a3ed1a3fbf9c

SHA256
06fa5d4e7fbfb1efdc19baa034601a894b21cf729785732853ced4bb40aca869

SHA512
f8fb6b7c93c4ab37f6e250ba8ac5c82f6e17fe52156cab81d34e91107d1da716b744bfe02ee0306497a3876d5352af789a1e66dab10e11e22065bac3050475fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\563B.tmp
MD5
149c2823b7eadbfb0a82388a2ab9494f

SHA1
415fe979ce5fd0064d2557a48745a3ed1a3fbf9c

SHA256
06fa5d4e7fbfb1efdc19baa034601a894b21cf729785732853ced4bb40aca869

SHA512
f8fb6b7c93c4ab37f6e250ba8ac5c82f6e17fe52156cab81d34e91107d1da716b744bfe02ee0306497a3876d5352af789a1e66dab10e11e22065bac3050475fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CCIGKH~1.DLL
MD5
aafd670c8407318a89a14453c1bfbcc1

SHA1
ebc4ffd7e7c17c25d17047581e9f728bb18e527c

SHA256
8c9ea69aa624cce70ba8cc22d42d306eed5decadaac3799fad19001f2b6eafd1

SHA512
7885593205fc96dd99c3691a960b562199f916c840d1ee70a826827dcdf1e2fd7c6340b8ff01a983d39994340ddc2d87d50be2c2f7e3e86f577aacb13a40e6fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CCIGKH~1.EXE
MD5
f884aebec5fa77261ff0ebeb9cf7cb70

SHA1
dbe55e9b4f5243d28841627b942dc642ddcb9dba

SHA256
90c99980edda505c3ce727884dfab5fbf1f6955442737254d92cb9f439e6039a

SHA512
f196a97dd6515be4308d84e8d61c45169af72db60b290dbe798b40791a99a15b6f404f542a22a60c86d6db050502e17cdc3c93994e67c0924580c41e877a2a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\broyolx.vbs
MD5
6cd8c59c3d37a23e5e866d8a39011065

SHA1
e8998a7f53d7e8f7a94753e084ffc1a236597cc3

SHA256
bc79feab4d1e68a6f95b661f983d2e5ce35eb092fb3cfd93ff1c0335c7f78fa9

SHA512
1ed761afc283f310f012259a1149866bfeea10d66d9f56d9d61bc4fe50e4a20edba04ed2f584b2e6856d9de2407da4fe5e47d3f4fc9e52f33b20cec6d6b56150

Download Submit
C:\Users\Admin\AppData\Local\Temp\ccigkhwuyec.exe
MD5
f884aebec5fa77261ff0ebeb9cf7cb70

SHA1
dbe55e9b4f5243d28841627b942dc642ddcb9dba

SHA256
90c99980edda505c3ce727884dfab5fbf1f6955442737254d92cb9f439e6039a

SHA512
f196a97dd6515be4308d84e8d61c45169af72db60b290dbe798b40791a99a15b6f404f542a22a60c86d6db050502e17cdc3c93994e67c0924580c41e877a2a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\peeqdwg.vbs
MD5
23e70375ea4e6000669c62435717d049

SHA1
6d09cd267f6e2c70dd32d20e85acabbd24163317

SHA256
487f9849325e325861a07f860032add93bef0593ad53f0e57f9f248c2dfa5442

SHA512
3cb8c1d69ab2c8f5619a4d9ace0510e3d7f7b2b1ff7cb873f6d2ac4c7e63e42d355a1d1ee78296bc20a7acc06008e237fa114352dae4cd38cfe32b49ce799766

Download Submit
C:\Users\Admin\AppData\Roaming\ieBjZPIwrfYTIGFlspmRCLiHMokMPmlPcKhNkxSfoosYGYzWBAYSlPqvVTmQDWkDtonXzSYWslJxzoqNPfkfBaFF\Aprile.msi
MD5
8467341efcb627b3b7c7997b9d18a2b3

SHA1
7902e7833c474f2fe4bd88669fcb103c8191617e

SHA256
7f8560f97d2f23f4006ca8bef5d9682f1e621636f821cc03ba2187835443dab4

SHA512
fb59e9b9c0a463977f1100076f37193dcfa29e2dac2487a19914409c78134b741ecdf59cf3797ccffb5628be008068e0e09d57326487dcc9f3c7864e859cf418

Download Submit
C:\Users\Admin\AppData\Roaming\ieBjZPIwrfYTIGFlspmRCLiHMokMPmlPcKhNkxSfoosYGYzWBAYSlPqvVTmQDWkDtonXzSYWslJxzoqNPfkfBaFF\Distrugge.msi
MD5
ca9ab8aa57ce91b56ea5f97fc2ff6deb

SHA1
0aed949c17de918b8fcdc28112279bd949660369

SHA256
1c62c5b0f8c9f1f6ebbe1df515175b6a5620c6c623d3c51b05042a1646bb4d02

SHA512
4f4f6037802a2dca4cee15c8564a2f0755aeb94903eb4467407c1a735d980333a4eb7b1b1ef4cf0923aefdb5a42fc6d4287139a7357ea9daa83783f8e1cb5c53

Download Submit
C:\Users\Admin\AppData\Roaming\ieBjZPIwrfYTIGFlspmRCLiHMokMPmlPcKhNkxSfoosYGYzWBAYSlPqvVTmQDWkDtonXzSYWslJxzoqNPfkfBaFF\Invece.msi
MD5
47ebadd7365c2186dacce71f058e30f0

SHA1
3ed2838977d943570245762f220ab6e790cc1a05

SHA256
9ef508c77abe54699966ce4bb3328e7fc76f3b8ad3b22e53ff5e449f238b7b2f

SHA512
2cebcac856c1b07f852edeed14b004db34204ca072c21daae5b0ebe726107243f5bf37062b4694a50a558add81ec9b546c3bc1c0f5fa6bb7cd73afebd82a3c41

Download Submit
C:\Users\Admin\AppData\Roaming\ieBjZPIwrfYTIGFlspmRCLiHMokMPmlPcKhNkxSfoosYGYzWBAYSlPqvVTmQDWkDtonXzSYWslJxzoqNPfkfBaFF\Tese.msi
MD5
c5de73401a4ad08730d7448f9db41add

SHA1
81bc3db1099aba71c987f8fd889d706a23618ca7

SHA256
aefe8c340ebcceae51f9017ccf56a74a6f5efc5012523d68a76b2d397dbc238a

SHA512
3004583935d5c1aa2e118abbe197bcac4c2f2f005741b9aef751d8de0b35acbc71ecd7993de44b32c4df45458c74e54c387fe88b842086583383f8625dc7cdb2

Download Submit
C:\Users\Admin\AppData\Roaming\ieBjZPIwrfYTIGFlspmRCLiHMokMPmlPcKhNkxSfoosYGYzWBAYSlPqvVTmQDWkDtonXzSYWslJxzoqNPfkfBaFF\Trascinava.exe.com
MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
C:\Users\Admin\AppData\Roaming\ieBjZPIwrfYTIGFlspmRCLiHMokMPmlPcKhNkxSfoosYGYzWBAYSlPqvVTmQDWkDtonXzSYWslJxzoqNPfkfBaFF\Trascinava.exe.com
MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
C:\Users\Admin\AppData\Roaming\ieBjZPIwrfYTIGFlspmRCLiHMokMPmlPcKhNkxSfoosYGYzWBAYSlPqvVTmQDWkDtonXzSYWslJxzoqNPfkfBaFF\Trascinava.exe.com
MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
C:\Users\Admin\AppData\Roaming\ieBjZPIwrfYTIGFlspmRCLiHMokMPmlPcKhNkxSfoosYGYzWBAYSlPqvVTmQDWkDtonXzSYWslJxzoqNPfkfBaFF\Y
MD5
ca9ab8aa57ce91b56ea5f97fc2ff6deb

SHA1
0aed949c17de918b8fcdc28112279bd949660369

SHA256
1c62c5b0f8c9f1f6ebbe1df515175b6a5620c6c623d3c51b05042a1646bb4d02

SHA512
4f4f6037802a2dca4cee15c8564a2f0755aeb94903eb4467407c1a735d980333a4eb7b1b1ef4cf0923aefdb5a42fc6d4287139a7357ea9daa83783f8e1cb5c53

Download Submit
\Users\Admin\AppData\Local\Temp\CCIGKH~1.DLL
MD5
aafd670c8407318a89a14453c1bfbcc1

SHA1
ebc4ffd7e7c17c25d17047581e9f728bb18e527c

SHA256
8c9ea69aa624cce70ba8cc22d42d306eed5decadaac3799fad19001f2b6eafd1

SHA512
7885593205fc96dd99c3691a960b562199f916c840d1ee70a826827dcdf1e2fd7c6340b8ff01a983d39994340ddc2d87d50be2c2f7e3e86f577aacb13a40e6fa

Download Submit
\Users\Admin\AppData\Local\Temp\CCIGKH~1.DLL
MD5
aafd670c8407318a89a14453c1bfbcc1

SHA1
ebc4ffd7e7c17c25d17047581e9f728bb18e527c

SHA256
8c9ea69aa624cce70ba8cc22d42d306eed5decadaac3799fad19001f2b6eafd1

SHA512
7885593205fc96dd99c3691a960b562199f916c840d1ee70a826827dcdf1e2fd7c6340b8ff01a983d39994340ddc2d87d50be2c2f7e3e86f577aacb13a40e6fa

Download Submit
\Users\Admin\AppData\Local\Temp\CCIGKH~1.DLL
MD5
aafd670c8407318a89a14453c1bfbcc1

SHA1
ebc4ffd7e7c17c25d17047581e9f728bb18e527c

SHA256
8c9ea69aa624cce70ba8cc22d42d306eed5decadaac3799fad19001f2b6eafd1

SHA512
7885593205fc96dd99c3691a960b562199f916c840d1ee70a826827dcdf1e2fd7c6340b8ff01a983d39994340ddc2d87d50be2c2f7e3e86f577aacb13a40e6fa

Download Submit
\Users\Admin\AppData\Local\Temp\CCIGKH~1.DLL
MD5
aafd670c8407318a89a14453c1bfbcc1

SHA1
ebc4ffd7e7c17c25d17047581e9f728bb18e527c

SHA256
8c9ea69aa624cce70ba8cc22d42d306eed5decadaac3799fad19001f2b6eafd1

SHA512
7885593205fc96dd99c3691a960b562199f916c840d1ee70a826827dcdf1e2fd7c6340b8ff01a983d39994340ddc2d87d50be2c2f7e3e86f577aacb13a40e6fa

Download Submit
\Users\Admin\AppData\Local\Temp\CCIGKH~1.DLL
MD5
aafd670c8407318a89a14453c1bfbcc1

SHA1
ebc4ffd7e7c17c25d17047581e9f728bb18e527c

SHA256
8c9ea69aa624cce70ba8cc22d42d306eed5decadaac3799fad19001f2b6eafd1

SHA512
7885593205fc96dd99c3691a960b562199f916c840d1ee70a826827dcdf1e2fd7c6340b8ff01a983d39994340ddc2d87d50be2c2f7e3e86f577aacb13a40e6fa

Download Submit
\Users\Admin\AppData\Local\Temp\CCIGKH~1.DLL
MD5
aafd670c8407318a89a14453c1bfbcc1

SHA1
ebc4ffd7e7c17c25d17047581e9f728bb18e527c

SHA256
8c9ea69aa624cce70ba8cc22d42d306eed5decadaac3799fad19001f2b6eafd1

SHA512
7885593205fc96dd99c3691a960b562199f916c840d1ee70a826827dcdf1e2fd7c6340b8ff01a983d39994340ddc2d87d50be2c2f7e3e86f577aacb13a40e6fa

Download Submit
\Users\Admin\AppData\Local\Temp\CCIGKH~1.DLL
MD5
aafd670c8407318a89a14453c1bfbcc1

SHA1
ebc4ffd7e7c17c25d17047581e9f728bb18e527c

SHA256
8c9ea69aa624cce70ba8cc22d42d306eed5decadaac3799fad19001f2b6eafd1

SHA512
7885593205fc96dd99c3691a960b562199f916c840d1ee70a826827dcdf1e2fd7c6340b8ff01a983d39994340ddc2d87d50be2c2f7e3e86f577aacb13a40e6fa

Download Submit
\Users\Admin\AppData\Local\Temp\CCIGKH~1.DLL
MD5
aafd670c8407318a89a14453c1bfbcc1

SHA1
ebc4ffd7e7c17c25d17047581e9f728bb18e527c

SHA256
8c9ea69aa624cce70ba8cc22d42d306eed5decadaac3799fad19001f2b6eafd1

SHA512
7885593205fc96dd99c3691a960b562199f916c840d1ee70a826827dcdf1e2fd7c6340b8ff01a983d39994340ddc2d87d50be2c2f7e3e86f577aacb13a40e6fa

Download Submit
\Users\Admin\AppData\Local\Temp\ccigkhwuyec.exe
MD5
f884aebec5fa77261ff0ebeb9cf7cb70

SHA1
dbe55e9b4f5243d28841627b942dc642ddcb9dba

SHA256
90c99980edda505c3ce727884dfab5fbf1f6955442737254d92cb9f439e6039a

SHA512
f196a97dd6515be4308d84e8d61c45169af72db60b290dbe798b40791a99a15b6f404f542a22a60c86d6db050502e17cdc3c93994e67c0924580c41e877a2a0e

Download Submit
\Users\Admin\AppData\Local\Temp\ccigkhwuyec.exe
MD5
f884aebec5fa77261ff0ebeb9cf7cb70

SHA1
dbe55e9b4f5243d28841627b942dc642ddcb9dba

SHA256
90c99980edda505c3ce727884dfab5fbf1f6955442737254d92cb9f439e6039a

SHA512
f196a97dd6515be4308d84e8d61c45169af72db60b290dbe798b40791a99a15b6f404f542a22a60c86d6db050502e17cdc3c93994e67c0924580c41e877a2a0e

Download Submit
\Users\Admin\AppData\Roaming\ieBjZPIwrfYTIGFlspmRCLiHMokMPmlPcKhNkxSfoosYGYzWBAYSlPqvVTmQDWkDtonXzSYWslJxzoqNPfkfBaFF\Trascinava.exe.com
MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
memory/268-71-0x0000000000000000-mapping.dmp

Download
memory/368-100-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/368-97-0x0000000001EE0000-0x000000000249A000-memory.dmp

Filesize
5.7MB

Download
memory/368-98-0x00000000028B1000-0x0000000002F0F000-memory.dmp

Filesize
6.4MB

Download
memory/368-110-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/368-90-0x0000000000000000-mapping.dmp

Download
memory/388-89-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/388-88-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/388-87-0x0000000001370000-0x0000000001A64000-memory.dmp

Filesize
7.0MB

Download
memory/388-81-0x0000000000000000-mapping.dmp

Download
memory/432-68-0x0000000000000000-mapping.dmp

Download
memory/932-77-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/932-73-0x0000000000000000-mapping.dmp

Download
memory/1064-107-0x00000000021E0000-0x000000000279A000-memory.dmp

Filesize
5.7MB

Download
memory/1064-101-0x0000000000000000-mapping.dmp

Download
memory/1064-108-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/1064-111-0x0000000002A71000-0x00000000030CF000-memory.dmp

Filesize
6.4MB

Download
memory/1076-59-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1156-83-0x0000000000000000-mapping.dmp

Download
memory/1280-60-0x0000000000000000-mapping.dmp

Download
memory/1616-64-0x0000000000000000-mapping.dmp

Download
memory/1840-63-0x0000000000000000-mapping.dmp

Download
memory/1960-61-0x0000000000000000-mapping.dmp

Download
memory/2004-112-0x0000000000000000-mapping.dmp

Download