Analysis
-
max time kernel
134s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
28-04-2021 19:03
Static task
static1
Behavioral task
behavioral1
Sample
5c1d1f9af1f90003d08803b341d23c69.exe
Resource
win7v20210410
General
-
Target
5c1d1f9af1f90003d08803b341d23c69.exe
-
Size
5.9MB
-
MD5
5c1d1f9af1f90003d08803b341d23c69
-
SHA1
323a3f7c38867632b1b3869357a09347e5bb15e0
-
SHA256
e7fc3d52074354612f8556b08284e769ba1fa0eb6e370414a163183ac7e3c9cd
-
SHA512
2e60162059a2cad4ecd1fb2afeeb1feed64f2109d1f5110439266249f71d6555ffe2934de1270ed909be8e1cd4adc2bba78e9868d25d7f5785aa05ff3a01b8a0
Malware Config
Extracted
danabot
1827
3
23.106.123.141:443
23.106.123.185:443
37.220.31.94:443
192.210.198.12:443
-
embedded_hash
AEF96B4D339B580ABB737F203C2D0F52
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
RUNDLL32.EXEflow pid process 6 1200 RUNDLL32.EXE 7 1200 RUNDLL32.EXE 8 1200 RUNDLL32.EXE 9 1200 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 2020 rundll32.exe -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 2020 rundll32.exe 2020 rundll32.exe 2020 rundll32.exe 2020 rundll32.exe 1200 RUNDLL32.EXE 1200 RUNDLL32.EXE 1200 RUNDLL32.EXE 1200 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 8 IoCs
Processes:
RUNDLL32.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\93PHUZFG\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XVLP3GFJ\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SLC8MVWU\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2MTLR0RV\desktop.ini RUNDLL32.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exeRUNDLL32.EXEdescription pid process Token: SeDebugPrivilege 2020 rundll32.exe Token: SeDebugPrivilege 1200 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
5c1d1f9af1f90003d08803b341d23c69.exerundll32.exedescription pid process target process PID 1672 wrote to memory of 2020 1672 5c1d1f9af1f90003d08803b341d23c69.exe rundll32.exe PID 1672 wrote to memory of 2020 1672 5c1d1f9af1f90003d08803b341d23c69.exe rundll32.exe PID 1672 wrote to memory of 2020 1672 5c1d1f9af1f90003d08803b341d23c69.exe rundll32.exe PID 1672 wrote to memory of 2020 1672 5c1d1f9af1f90003d08803b341d23c69.exe rundll32.exe PID 1672 wrote to memory of 2020 1672 5c1d1f9af1f90003d08803b341d23c69.exe rundll32.exe PID 1672 wrote to memory of 2020 1672 5c1d1f9af1f90003d08803b341d23c69.exe rundll32.exe PID 1672 wrote to memory of 2020 1672 5c1d1f9af1f90003d08803b341d23c69.exe rundll32.exe PID 2020 wrote to memory of 1200 2020 rundll32.exe RUNDLL32.EXE PID 2020 wrote to memory of 1200 2020 rundll32.exe RUNDLL32.EXE PID 2020 wrote to memory of 1200 2020 rundll32.exe RUNDLL32.EXE PID 2020 wrote to memory of 1200 2020 rundll32.exe RUNDLL32.EXE PID 2020 wrote to memory of 1200 2020 rundll32.exe RUNDLL32.EXE PID 2020 wrote to memory of 1200 2020 rundll32.exe RUNDLL32.EXE PID 2020 wrote to memory of 1200 2020 rundll32.exe RUNDLL32.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c1d1f9af1f90003d08803b341d23c69.exe"C:\Users\Admin\AppData\Local\Temp\5c1d1f9af1f90003d08803b341d23c69.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\5C1D1F~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\5C1D1F~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\5C1D1F~1.DLL,GBEHTA==3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5C1D1F~1.DLLMD5
c19163904d3f9adb6cf1263c4aed1fcc
SHA147406727b45193ab6de016da9cca671744ed2380
SHA256afb8cd98a52a7ecc07305fc1f5c816b96b3660f247f47cfce6a3629ec8ab37fe
SHA5127a165f43754aede42a9863ea7aca7044661f577af2647368a424db72be4ba6167d6ccd7e9e53b0716dc84ab0378fe62efe3df6028a1879de496aa55bbe0f08a3
-
\Users\Admin\AppData\Local\Temp\5C1D1F~1.DLLMD5
c19163904d3f9adb6cf1263c4aed1fcc
SHA147406727b45193ab6de016da9cca671744ed2380
SHA256afb8cd98a52a7ecc07305fc1f5c816b96b3660f247f47cfce6a3629ec8ab37fe
SHA5127a165f43754aede42a9863ea7aca7044661f577af2647368a424db72be4ba6167d6ccd7e9e53b0716dc84ab0378fe62efe3df6028a1879de496aa55bbe0f08a3
-
\Users\Admin\AppData\Local\Temp\5C1D1F~1.DLLMD5
c19163904d3f9adb6cf1263c4aed1fcc
SHA147406727b45193ab6de016da9cca671744ed2380
SHA256afb8cd98a52a7ecc07305fc1f5c816b96b3660f247f47cfce6a3629ec8ab37fe
SHA5127a165f43754aede42a9863ea7aca7044661f577af2647368a424db72be4ba6167d6ccd7e9e53b0716dc84ab0378fe62efe3df6028a1879de496aa55bbe0f08a3
-
\Users\Admin\AppData\Local\Temp\5C1D1F~1.DLLMD5
c19163904d3f9adb6cf1263c4aed1fcc
SHA147406727b45193ab6de016da9cca671744ed2380
SHA256afb8cd98a52a7ecc07305fc1f5c816b96b3660f247f47cfce6a3629ec8ab37fe
SHA5127a165f43754aede42a9863ea7aca7044661f577af2647368a424db72be4ba6167d6ccd7e9e53b0716dc84ab0378fe62efe3df6028a1879de496aa55bbe0f08a3
-
\Users\Admin\AppData\Local\Temp\5C1D1F~1.DLLMD5
c19163904d3f9adb6cf1263c4aed1fcc
SHA147406727b45193ab6de016da9cca671744ed2380
SHA256afb8cd98a52a7ecc07305fc1f5c816b96b3660f247f47cfce6a3629ec8ab37fe
SHA5127a165f43754aede42a9863ea7aca7044661f577af2647368a424db72be4ba6167d6ccd7e9e53b0716dc84ab0378fe62efe3df6028a1879de496aa55bbe0f08a3
-
\Users\Admin\AppData\Local\Temp\5C1D1F~1.DLLMD5
c19163904d3f9adb6cf1263c4aed1fcc
SHA147406727b45193ab6de016da9cca671744ed2380
SHA256afb8cd98a52a7ecc07305fc1f5c816b96b3660f247f47cfce6a3629ec8ab37fe
SHA5127a165f43754aede42a9863ea7aca7044661f577af2647368a424db72be4ba6167d6ccd7e9e53b0716dc84ab0378fe62efe3df6028a1879de496aa55bbe0f08a3
-
\Users\Admin\AppData\Local\Temp\5C1D1F~1.DLLMD5
c19163904d3f9adb6cf1263c4aed1fcc
SHA147406727b45193ab6de016da9cca671744ed2380
SHA256afb8cd98a52a7ecc07305fc1f5c816b96b3660f247f47cfce6a3629ec8ab37fe
SHA5127a165f43754aede42a9863ea7aca7044661f577af2647368a424db72be4ba6167d6ccd7e9e53b0716dc84ab0378fe62efe3df6028a1879de496aa55bbe0f08a3
-
\Users\Admin\AppData\Local\Temp\5C1D1F~1.DLLMD5
c19163904d3f9adb6cf1263c4aed1fcc
SHA147406727b45193ab6de016da9cca671744ed2380
SHA256afb8cd98a52a7ecc07305fc1f5c816b96b3660f247f47cfce6a3629ec8ab37fe
SHA5127a165f43754aede42a9863ea7aca7044661f577af2647368a424db72be4ba6167d6ccd7e9e53b0716dc84ab0378fe62efe3df6028a1879de496aa55bbe0f08a3
-
\Users\Admin\AppData\Local\Temp\5C1D1F~1.DLLMD5
c19163904d3f9adb6cf1263c4aed1fcc
SHA147406727b45193ab6de016da9cca671744ed2380
SHA256afb8cd98a52a7ecc07305fc1f5c816b96b3660f247f47cfce6a3629ec8ab37fe
SHA5127a165f43754aede42a9863ea7aca7044661f577af2647368a424db72be4ba6167d6ccd7e9e53b0716dc84ab0378fe62efe3df6028a1879de496aa55bbe0f08a3
-
memory/1200-79-0x00000000009A0000-0x0000000000F59000-memory.dmpFilesize
5.7MB
-
memory/1200-82-0x0000000002941000-0x0000000002F9F000-memory.dmpFilesize
6.4MB
-
memory/1200-72-0x0000000000000000-mapping.dmp
-
memory/1200-81-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/1672-59-0x0000000075971000-0x0000000075973000-memory.dmpFilesize
8KB
-
memory/1672-60-0x0000000005080000-0x0000000005775000-memory.dmpFilesize
7.0MB
-
memory/1672-61-0x0000000000400000-0x0000000003157000-memory.dmpFilesize
45.3MB
-
memory/1672-62-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2020-71-0x0000000003290000-0x0000000003291000-memory.dmpFilesize
4KB
-
memory/2020-80-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/2020-78-0x0000000002C21000-0x000000000327F000-memory.dmpFilesize
6.4MB
-
memory/2020-63-0x0000000000000000-mapping.dmp
-
memory/2020-70-0x0000000002390000-0x0000000002949000-memory.dmpFilesize
5.7MB