Analysis
-
max time kernel
136s -
max time network
110s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
31-05-2021 14:22
Static task
static1
Behavioral task
behavioral1
Sample
6b56ecce75b9c20ca1e145efdd66821c.exe
Resource
win7v20210408
General
-
Target
6b56ecce75b9c20ca1e145efdd66821c.exe
-
Size
6.1MB
-
MD5
6b56ecce75b9c20ca1e145efdd66821c
-
SHA1
71cbfe95d3a69841c37f01939b6c517a55920a18
-
SHA256
97b7da2ab88a53b25084a5e5a6fa93a38485baa9fce0406ed6f4f041f35d88a2
-
SHA512
873852dc19ac838f0f2a152518dbb3f18c70eabba7345733dd7b042268a5eaac942aad762e1459f878863798bafd884029a608a859ece44e2cf1200fd33cc0c2
Malware Config
Extracted
danabot
1827
3
184.95.51.183:443
184.95.51.175:443
192.210.198.12:443
184.95.51.180:443
-
embedded_hash
AEF96B4D339B580ABB737F203C2D0F52
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
RUNDLL32.EXEflow pid process 2 316 RUNDLL32.EXE 3 316 RUNDLL32.EXE 5 316 RUNDLL32.EXE 7 316 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 1284 rundll32.exe -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 1284 rundll32.exe 1284 rundll32.exe 1284 rundll32.exe 1284 rundll32.exe 316 RUNDLL32.EXE 316 RUNDLL32.EXE 316 RUNDLL32.EXE 316 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 3 IoCs
Processes:
RUNDLL32.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HNHPAZTY\desktop.ini RUNDLL32.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exeRUNDLL32.EXEdescription pid process Token: SeDebugPrivilege 1284 rundll32.exe Token: SeDebugPrivilege 316 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
6b56ecce75b9c20ca1e145efdd66821c.exerundll32.exedescription pid process target process PID 520 wrote to memory of 1284 520 6b56ecce75b9c20ca1e145efdd66821c.exe rundll32.exe PID 520 wrote to memory of 1284 520 6b56ecce75b9c20ca1e145efdd66821c.exe rundll32.exe PID 520 wrote to memory of 1284 520 6b56ecce75b9c20ca1e145efdd66821c.exe rundll32.exe PID 520 wrote to memory of 1284 520 6b56ecce75b9c20ca1e145efdd66821c.exe rundll32.exe PID 520 wrote to memory of 1284 520 6b56ecce75b9c20ca1e145efdd66821c.exe rundll32.exe PID 520 wrote to memory of 1284 520 6b56ecce75b9c20ca1e145efdd66821c.exe rundll32.exe PID 520 wrote to memory of 1284 520 6b56ecce75b9c20ca1e145efdd66821c.exe rundll32.exe PID 1284 wrote to memory of 316 1284 rundll32.exe RUNDLL32.EXE PID 1284 wrote to memory of 316 1284 rundll32.exe RUNDLL32.EXE PID 1284 wrote to memory of 316 1284 rundll32.exe RUNDLL32.EXE PID 1284 wrote to memory of 316 1284 rundll32.exe RUNDLL32.EXE PID 1284 wrote to memory of 316 1284 rundll32.exe RUNDLL32.EXE PID 1284 wrote to memory of 316 1284 rundll32.exe RUNDLL32.EXE PID 1284 wrote to memory of 316 1284 rundll32.exe RUNDLL32.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b56ecce75b9c20ca1e145efdd66821c.exe"C:\Users\Admin\AppData\Local\Temp\6b56ecce75b9c20ca1e145efdd66821c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6B56EC~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\6B56EC~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\6B56EC~1.DLL,Zj4oNA==3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6B56EC~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\6B56EC~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\6B56EC~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\6B56EC~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\6B56EC~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\6B56EC~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\6B56EC~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\6B56EC~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\6B56EC~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
memory/316-73-0x0000000000000000-mapping.dmp
-
memory/316-82-0x0000000002A81000-0x00000000030E0000-memory.dmpFilesize
6.4MB
-
memory/316-81-0x00000000026F0000-0x00000000026F1000-memory.dmpFilesize
4KB
-
memory/316-79-0x0000000002040000-0x0000000002605000-memory.dmpFilesize
5.8MB
-
memory/520-61-0x0000000000400000-0x0000000000B14000-memory.dmpFilesize
7.1MB
-
memory/520-60-0x0000000002A10000-0x0000000003117000-memory.dmpFilesize
7.0MB
-
memory/520-62-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/520-59-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB
-
memory/1284-63-0x0000000000000000-mapping.dmp
-
memory/1284-72-0x0000000003220000-0x0000000003221000-memory.dmpFilesize
4KB
-
memory/1284-71-0x0000000002AF1000-0x0000000003150000-memory.dmpFilesize
6.4MB
-
memory/1284-80-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/1284-70-0x0000000002070000-0x0000000002635000-memory.dmpFilesize
5.8MB