Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    13/05/2021, 18:56

General

  • Target

    2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe

  • Size

    731KB

  • MD5

    105f97e06f45250a6448035b94f2ef2b

  • SHA1

    3819346f3b8c05add77c89205a58533dabbc7249

  • SHA256

    2051799f92fd036d6e1c8a9c06a4aea85a9509214cd0623c0df2fe62bd99986b

  • SHA512

    9a57ebc3835d2abedb966a501bfb7c2d15769a8f3a95320c00dc91e892710d182fffd4f1971dda989c5129da493cb64ce329cb9b8a2aa1177167ecadd07cc3d7

Malware Config

Extracted

Family

cryptbot

C2

remdny42.top

morpgr04.top

Attributes
  • payload_url

    http://sulnom06.top/download.php?file=lv.exe

Extracted

Family

danabot

Version

1827

Botnet

3

C2

184.95.51.183:443

184.95.51.175:443

192.210.198.12:443

184.95.51.180:443

Attributes
  • embedded_hash

    AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain
rsa_pubkey.plain

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • CryptBot Payload 2 IoCs
  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 8 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe
    "C:\Users\Admin\AppData\Local\Temp\2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GehhlV.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2152
      • C:\Users\Admin\AppData\Local\Temp\GehhlV.exe
        "C:\Users\Admin\AppData\Local\Temp\GehhlV.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
          "C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2104
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c IEupGZtiGuhYLuXTzhQLTFqwaOOuZUNPiXjCGSSBCwddKCJqvZSswXKrDtQRkYoManQNUcjBcfoRgKsQyNJZwvOljoY
            5⤵
              PID:1848
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c wqfETEXjLVywMsVMOSOTMqMbfoKWJGBLvKmxZEYKNytlIHjJAevzxyPwgRfKUwCyxxEeSBMpUtuHVBPHVqcHl
              5⤵
                PID:3456
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c ssVbyofhQLCZQhelRYdjmfZiuNwIO
                5⤵
                  PID:8
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c FVUjrhucvEUGgxyWLCELpvsYHwsOsauGnWuHtDlPrcCLsSwFepwmtrKoDWEwWartbgisgbRisOINUFGOqMMidHCcjXtiYpSKsngrLJsEaUifxWgYdQwpGWNQLLydzJooVXvv
                  5⤵
                    PID:3852
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c DrdciOcmhwdIyRoiJtcKnsZEqkIMZzbASGMMKOmiadnKOHhRZqjSqLSj
                    5⤵
                      PID:1060
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c LxVuJATDQQnycvUFhso
                      5⤵
                        PID:1704
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c fQaXQMYuEmuOmJZzDwIPFuYQOMEDahNzKxNVeXfXCNZdKKFMbBwkJzhoRBptoxOdLMryVrsFMLjSiHuriRuQkBKsuFtAOlPiYIEYHmQzlvmXucwpcyXdgXylwLZdZQRBW
                        5⤵
                          PID:1844
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c TmeovHqMGPeMkLDUyIhnSqDx
                          5⤵
                            PID:4080
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c VAAzzFXwqBCuhJffCsfigAhMyLogbjSVIkAiAahlyLlpwORYXpdJhjHcjNgHvIDOJGnepoOpryeDftLdTpdgWpIcDtUNrFNvovAxfPPPxuFiltuieXNhafRmYenthwunsGcSEdqtxBUQ
                            5⤵
                              PID:3608
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c AknYMKyRArSEqvhdKBaqiQDJhDLWJTRcwWbRquBdqGRDCgDUNNJZBQcKHOLoZooHjbDtYcdEqwZBYqiYqQpVpRTkA
                              5⤵
                                PID:1056
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c lkcadRbldtLnWavyZmQULHHMopZjbxEsDkkypIKirOJrhBUQmrSzcGwDEIpiSkMVmzVKisWsOIQXXDnHgpNxClWXpIBAnDfSeNDUGpJiiBFMPrFqlCS
                                5⤵
                                  PID:3948
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c bazfbXAmPvSkzXVpqEqyAFjwFloyeBdWKGcJxhvJIpsLIzaRovZFBNoRyaKhPcvgyWBMCkOMisvdhBakRdXFBKxXbDEeDpThNrFMSGf
                                  5⤵
                                    PID:1224
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c HjnldSDDZncnbRMcCDgYGMpXboClWFzlwqYfklGFZqetNxQWdplgsdfVeAMifzHzykbvTbpaXJZGKypeaGTMctSKLejKbnfGzIYCXxrTqSdIsJkXsJPImVYqaNLQlnUmzahwuGyYDqLDN
                                    5⤵
                                      PID:2588
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c zwRgzNJGibKXlpIjIBXRgYvpRKEQympxhizJZV
                                      5⤵
                                        PID:2284
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c iPNkPsovVfsspGVVxEHbJpS
                                        5⤵
                                          PID:3572
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c HhfKeQYhMbQeBNHSIhIANoqNskYysncXWjDCwbzydrEMQTxGXPOcAsNmhCzQRTWgwSyglyRlUCpKEhXbRai
                                          5⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3972
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c JZbEntgmtCgbifLYOuvSXDBXoeVZEWZmLzEwxAPyQausgMDgCZIKVfEunmvcofUiDPLNLJDgddeFvlJcmHbFhg
                                          5⤵
                                            PID:1176
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c vPnDVrzXBbYNmqPCTcxxEhZJhPwWBSgUgkfYjyHkWzBibvlxKtDlTTZoPPfyebcIptmgKQfNNpnlMRkRFGkbgtqxki
                                            5⤵
                                              PID:3952
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c bQConYSYzXWKTOQvKcOcYDnmcjXxtryeD
                                              5⤵
                                                PID:612
                                                • C:\Windows\System32\Conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  6⤵
                                                    PID:1060
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c SWkqqjUTSUJWsJbHdZvLlTseNjwbTfSTukWTkJcCBtLEQmUgWvNyFSbYFojNkvZCePPuMEvGEUpuiNjhaMBvBMggOYgevHsyypCqJ
                                                  5⤵
                                                    PID:2384
                                                    • C:\Windows\System32\Conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      6⤵
                                                        PID:1704
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c BsquBLIsQRWZcnVCqfBBsOdxpWCtqYkkEElpvclCGbivybkTpCojnovNwFWEoDdRGKxRhLyFyYVTGTgLLJUnQYNcibiRnFzeidQcrzFnvCumhDuoslTmI
                                                      5⤵
                                                        PID:1812
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /c QTiOfHdCBoHxLdwvwNIQbnNnOoEJqH & LsYakXYEXnGEvHrLYMdqwJpJayIqurHBTfWeNYPnroKaRTsQKbGWKGReogZufXnUQtKuLqYZWRXSYRSnNRfJvKRhbTUnYJpyKQBNpkyJnGZSJZtscBabHPnujvIRumwhIRi & fygCMGlPKZDnPDrbdMnVscAMCgDZFMpS & VwdjPLwEIchTlwDvEWWzjQUFBZbrkpYPLHTBMlAqvdIqhTajZCwPjnEyuLKPhYamvbiDowJzcVWViUsIHkrJioDjeOcwmLNnXpDQMPtYSIzsCJXjzeowUJshUUAzGI & KonXYsBWRiyQmPjKzRpIbCMDgSfWRgKalPJotLYVRudTPTRnIpiBbZcovUJywFtCvNFKurGHShQskSOxqRgIipVlzBMpwSTkeNbwhiaECmIpptWDygylsvchScsFdvGZzEfn & MiTnJyHALwgEptMNJUFslpSQNguTIPEPnoaijLIsOMuzeqiaTjKKJulDgeLxYOSWbm & qLEBYjgDbrnNNiNZvyTysXPTpqh & ZUpWDTiHfLMnxCNAQfXhkOcRDzOeVLsXYWDDTBlTquKLzcLPlfeUequkna & pttLDzOmbYpGftthytKniHZRFJbUYPayBiwOVxisEWhQwINPYNwuNTjByhyUVTB & FryirfsKXaTlxoQWVIWkOjsHUmJIgjcKcFlXDGLJcdpcZwiXvoYhXdTzMnjEGIvKWoPOXSzfWjPbrWHTsLkygoNyMRktzirMUnnRj & ZEPIdKAvdQRzjUbdcOcKeuGgWPpeCEbQGZLGdFReEfAchqUofEeKcBdTXAMB & nTMaqMhoQZQXauMFkwWUqMXBNxtISJQTfAyvOejhHZmFjNecDhMnQGALVlFGHEdioWHSqdRpOIhqhafZaJtE & seJZzAEvGFeJsvfulchvCKizAbCVGhYAMpRTYSGQhMirlsVWZTigRixHVfmWXJQaGCWoFvoaOvpQCtooBGVMuKIEPpYIaKTEWPvIcNsDLPmxYEtRudxdNtjWTsacbmZrDETNHANOgaqdlg & lyiCwdCQSCAOrcWyjPvQzKdlFDGecrVLFLifdXXNwOwkuMKaajOAOnjAOXWnKmcPGPpahGPgRIOFJyrTShKpgxWunHBzwmrCa & EsCsyLvAJuJHQITeFvPjAkSeTFychaFjhvBMdAiYMOL & bRRSmYTGMuLamAnAGqjdAvzxiiMtfQmMAwEeOjWfnZAuKojPeHaLBcdqbvLakOsVGZSbVcLxtXRBWhJYUWeHnOltLEFsADrJHEALdPUHVYGEDOrlMNbfMJvRONMsQ & TATiTaMYIyexLAiGBXAxENuOXYiIWCeDQBtyLcULbOyahsXWKokPQcPyxtlVltey & nElcwUuePWQIOBFqk & OdhNxMZLGlZAzMZfONNBIhyMqnYbGDFUZyhOOLpbvdgVrgDtInNRhJfAkBMVNBtrEtBhnkAeDfysYlJLVUOiPNHfPMDhZgKUjldYNfFbYKgXEYCqRqZSNWhRbjbLIjrgElyNTKYGgsptmJKRl & vYgRifXmAARUOLHZaxSOiiwzEcMosOBGBuQtqNrQQzpnOxDnbmddZvxgXUhLCOiMZkaIUDZFdwXNXDFpSgLRbk & tLBiymshejbnDwUDUALZXmHszftThrffNEgXzcTuZNVBAtwiXLRsMkIFrpNQcbZYWiLYNXpnHEqpDuRfhWWCjYDCVJTpIrLBN & EazrxZBaJikmwXanCnBbMXEpettqQETncHBmVpCWwTgcdvHWRpAjqdpGNlqdVBCyhNrxcTCaVEcTJpSFvooGtGbybULLpjqAspiCzjAYHiscUdXEsxTNaVwGfYXBiQpJEVBAwfjpHlYW & wluXuzOahiciAhcfZQQXHRYPbDwoJyiXtshNQDwvcdsNuaAeQTIx & ZHlksADaFJiqnrpZHmcPzCsAkJteYsP & NOyJrCmrbtPHpNHfsrpxhEObdKqHcAzhTKjJYmVyZssgMKdbwPLVoxpoqIaaCRIXLCNmAYs & ircVhmKGxCGGPnynArJfiCDoJxDlWRWrbUNyZgVBXMYZkwihbgYvgwKEAhkSVAJDFCoVKqmjiiaxEDWIjdNISAOvpoEMerFvecxITjCbPMgiIfqXdDFFNwKyNMLCcN & tCVsopgOqOdSukHNUiHcmbZJwLgUuAZwwCl & MXSNeOFQboEUuYRxOsKHDjdbVzHmOgQDqrwWfTzKRojSuzOoJEhKSCqAHcSJuywoawTeXVyUYZPxqndBEmQlwuKneBf & wKDMutAyAMkNnaMTNGAoystHgRukdcZvGkTgcrhVYlqShrLJxRKvquOJFWbfXgPtMPijnnbKzEpUdjzkyvRmKDcmbpImFYXKcWynVnlWzqevXUzaCjpBbfzoxIPgPYyxGmnxu & fHjVyKAYCDQdWaOvjyCXthJWuxVIQbcYkHWCfClJHcykbmeMFpjzSpReXfOKPSotoStfcjiKVSfIibnHaoeGlwyePUEZNmUOhqrFcNszeCbZTpUARuaGQBUuMwmBHoXvYAxuzSjFR & C:\Windows\system32\cmd < Sta.vssm
                                                        5⤵
                                                          PID:4020
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd
                                                            6⤵
                                                              PID:3856
                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                findstr /V /R "^hSpSigSzxLDGSondFTKDkxVhNUxDcdcqRWsJEwXjjqzRIWcClcFKPiZTXVtjTfXtfCOWROMEVndkqrEQnSaqLLlJWbMIWL$" Cui.vssm
                                                                7⤵
                                                                  PID:1076
                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.com
                                                                  Accostarmi.exe.com c
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  PID:2160
                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.com
                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.com c
                                                                    8⤵
                                                                    • Executes dropped EXE
                                                                    • Checks processor information in registry
                                                                    • Modifies registry class
                                                                    PID:428
                                                                    • C:\Users\Admin\AppData\Local\Temp\dhwefecxurd.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\dhwefecxurd.exe"
                                                                      9⤵
                                                                      • Executes dropped EXE
                                                                      PID:2760
                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\DHWEFE~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\DHWEFE~1.EXE
                                                                        10⤵
                                                                        • Loads dropped DLL
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3952
                                                                        • C:\Windows\SysWOW64\RUNDLL32.EXE
                                                                          C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\DHWEFE~1.DLL,XDoiLDZ4BaQ=
                                                                          11⤵
                                                                          • Blocklisted process makes network request
                                                                          • Loads dropped DLL
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:740
                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\uluswhprg.vbs"
                                                                      9⤵
                                                                        PID:3844
                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\kuqfqsrpjcw.vbs"
                                                                        9⤵
                                                                        • Blocklisted process makes network request
                                                                        • Modifies system certificate store
                                                                        PID:4012
                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                    ping 127.0.0.1 -n 30
                                                                    7⤵
                                                                    • Runs ping.exe
                                                                    PID:3868
                                                            • C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Drops startup file
                                                              PID:2372
                                                              • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                                                "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                PID:3972
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\jINZmHHD & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe"
                                                          2⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4072
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout 3
                                                            3⤵
                                                            • Delays execution with timeout.exe
                                                            PID:3864

                                                      Network

                                                            MITRE ATT&CK Enterprise v6

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • memory/428-177-0x0000000001360000-0x0000000001361000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/740-198-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/740-195-0x0000000004710000-0x0000000004CD5000-memory.dmp

                                                              Filesize

                                                              5.8MB

                                                            • memory/740-200-0x0000000005371000-0x00000000059D0000-memory.dmp

                                                              Filesize

                                                              6.4MB

                                                            • memory/2372-171-0x0000000000470000-0x000000000051E000-memory.dmp

                                                              Filesize

                                                              696KB

                                                            • memory/2372-172-0x0000000000400000-0x0000000000461000-memory.dmp

                                                              Filesize

                                                              388KB

                                                            • memory/2760-184-0x0000000000400000-0x0000000000B14000-memory.dmp

                                                              Filesize

                                                              7.1MB

                                                            • memory/2760-183-0x0000000002F90000-0x0000000003697000-memory.dmp

                                                              Filesize

                                                              7.0MB

                                                            • memory/2760-185-0x0000000000C60000-0x0000000000DAA000-memory.dmp

                                                              Filesize

                                                              1.3MB

                                                            • memory/3952-196-0x0000000004F41000-0x00000000055A0000-memory.dmp

                                                              Filesize

                                                              6.4MB

                                                            • memory/3952-197-0x0000000000800000-0x00000000008AE000-memory.dmp

                                                              Filesize

                                                              696KB

                                                            • memory/3952-190-0x0000000004480000-0x0000000004A45000-memory.dmp

                                                              Filesize

                                                              5.8MB

                                                            • memory/3952-191-0x0000000004B90000-0x0000000004B91000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3972-115-0x0000000000400000-0x00000000004E5000-memory.dmp

                                                              Filesize

                                                              916KB

                                                            • memory/3972-175-0x0000000000400000-0x0000000000461000-memory.dmp

                                                              Filesize

                                                              388KB

                                                            • memory/3972-114-0x0000000002190000-0x0000000002271000-memory.dmp

                                                              Filesize

                                                              900KB

                                                            • memory/3972-174-0x0000000002070000-0x0000000002096000-memory.dmp

                                                              Filesize

                                                              152KB