Analysis
-
max time kernel
135s -
max time network
68s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-05-2021 08:07
Static task
static1
Behavioral task
behavioral1
Sample
d6432b92be7eb3decbfc25b5e8a1b5c8.exe
Resource
win7v20210410
General
-
Target
d6432b92be7eb3decbfc25b5e8a1b5c8.exe
-
Size
6.1MB
-
MD5
d6432b92be7eb3decbfc25b5e8a1b5c8
-
SHA1
4283fed9989befe8bcb180cb5e43313d8878cc49
-
SHA256
eab508f41f98339ead04d09fc47c537e6e1b975f8233127d81196196b974bf27
-
SHA512
e63bef350f31543ddacb7b58fbbc57c4ff478542333c2603b5bfb09267c69f876c115a8b0160b442ab2b9d8dd8eb57b4e4079a907d391595101c71458ad8bcca
Malware Config
Extracted
danabot
1827
3
184.95.51.183:443
184.95.51.175:443
192.210.198.12:443
184.95.51.180:443
-
embedded_hash
AEF96B4D339B580ABB737F203C2D0F52
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
RUNDLL32.EXEflow pid process 10 196 RUNDLL32.EXE 12 196 RUNDLL32.EXE 14 196 RUNDLL32.EXE 16 196 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 3964 rundll32.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 3964 rundll32.exe 196 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exeRUNDLL32.EXEdescription pid process Token: SeDebugPrivilege 3964 rundll32.exe Token: SeDebugPrivilege 196 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d6432b92be7eb3decbfc25b5e8a1b5c8.exerundll32.exedescription pid process target process PID 3932 wrote to memory of 3964 3932 d6432b92be7eb3decbfc25b5e8a1b5c8.exe rundll32.exe PID 3932 wrote to memory of 3964 3932 d6432b92be7eb3decbfc25b5e8a1b5c8.exe rundll32.exe PID 3932 wrote to memory of 3964 3932 d6432b92be7eb3decbfc25b5e8a1b5c8.exe rundll32.exe PID 3964 wrote to memory of 196 3964 rundll32.exe RUNDLL32.EXE PID 3964 wrote to memory of 196 3964 rundll32.exe RUNDLL32.EXE PID 3964 wrote to memory of 196 3964 rundll32.exe RUNDLL32.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6432b92be7eb3decbfc25b5e8a1b5c8.exe"C:\Users\Admin\AppData\Local\Temp\d6432b92be7eb3decbfc25b5e8a1b5c8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\D6432B~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\D6432B~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\D6432B~1.DLL,ZlsLLDbMBQ==3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\D6432B~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\D6432B~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\D6432B~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
memory/196-123-0x0000000000000000-mapping.dmp
-
memory/196-128-0x0000000005391000-0x00000000059F0000-memory.dmpFilesize
6.4MB
-
memory/3932-114-0x0000000002EE0000-0x00000000035E7000-memory.dmpFilesize
7.0MB
-
memory/3932-115-0x0000000000400000-0x0000000000B14000-memory.dmpFilesize
7.1MB
-
memory/3932-116-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3964-117-0x0000000000000000-mapping.dmp
-
memory/3964-122-0x0000000005541000-0x0000000005BA0000-memory.dmpFilesize
6.4MB
-
memory/3964-125-0x0000000003200000-0x00000000032AE000-memory.dmpFilesize
696KB