Analysis
-
max time kernel
138s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
02-06-2021 12:20
Static task
static1
Behavioral task
behavioral1
Sample
5d580ebb6471dbf5a504c7f7e112d6e1.exe
Resource
win7v20210408
General
-
Target
5d580ebb6471dbf5a504c7f7e112d6e1.exe
-
Size
6.0MB
-
MD5
5d580ebb6471dbf5a504c7f7e112d6e1
-
SHA1
8bfa4d1fd72185c854e303fb4a7430ae2a548afe
-
SHA256
4b66dd3b1e34308243c05094cf7b8e320f83eb453d58b80aaf9059fade40fcc1
-
SHA512
22e4b9caaaff0e00237bbac55a9043e3f374dadcaaaa0894e16fe81532c2d226d2752159fa42f9caafded3eac15b143bcea1d1439133ad22fea29b80b9da88f0
Malware Config
Extracted
danabot
1827
3
184.95.51.183:443
184.95.51.175:443
192.210.198.12:443
184.95.51.180:443
-
embedded_hash
AEF96B4D339B580ABB737F203C2D0F52
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
RUNDLL32.EXEflow pid process 13 936 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 2940 rundll32.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 2940 rundll32.exe 2940 rundll32.exe 936 RUNDLL32.EXE 936 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RUNDLL32.EXEdescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RUNDLL32.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exeRUNDLL32.EXEpowershell.exepid process 3672 powershell.exe 3672 powershell.exe 3672 powershell.exe 936 RUNDLL32.EXE 936 RUNDLL32.EXE 1000 powershell.exe 1000 powershell.exe 1000 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2940 rundll32.exe Token: SeDebugPrivilege 936 RUNDLL32.EXE Token: SeDebugPrivilege 3672 powershell.exe Token: SeDebugPrivilege 1000 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
RUNDLL32.EXEpid process 936 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
5d580ebb6471dbf5a504c7f7e112d6e1.exerundll32.exeRUNDLL32.EXEpowershell.exedescription pid process target process PID 808 wrote to memory of 2940 808 5d580ebb6471dbf5a504c7f7e112d6e1.exe rundll32.exe PID 808 wrote to memory of 2940 808 5d580ebb6471dbf5a504c7f7e112d6e1.exe rundll32.exe PID 808 wrote to memory of 2940 808 5d580ebb6471dbf5a504c7f7e112d6e1.exe rundll32.exe PID 2940 wrote to memory of 936 2940 rundll32.exe RUNDLL32.EXE PID 2940 wrote to memory of 936 2940 rundll32.exe RUNDLL32.EXE PID 2940 wrote to memory of 936 2940 rundll32.exe RUNDLL32.EXE PID 936 wrote to memory of 3672 936 RUNDLL32.EXE powershell.exe PID 936 wrote to memory of 3672 936 RUNDLL32.EXE powershell.exe PID 936 wrote to memory of 3672 936 RUNDLL32.EXE powershell.exe PID 936 wrote to memory of 1000 936 RUNDLL32.EXE powershell.exe PID 936 wrote to memory of 1000 936 RUNDLL32.EXE powershell.exe PID 936 wrote to memory of 1000 936 RUNDLL32.EXE powershell.exe PID 1000 wrote to memory of 3624 1000 powershell.exe nslookup.exe PID 1000 wrote to memory of 3624 1000 powershell.exe nslookup.exe PID 1000 wrote to memory of 3624 1000 powershell.exe nslookup.exe PID 936 wrote to memory of 2872 936 RUNDLL32.EXE schtasks.exe PID 936 wrote to memory of 2872 936 RUNDLL32.EXE schtasks.exe PID 936 wrote to memory of 2872 936 RUNDLL32.EXE schtasks.exe PID 936 wrote to memory of 4072 936 RUNDLL32.EXE schtasks.exe PID 936 wrote to memory of 4072 936 RUNDLL32.EXE schtasks.exe PID 936 wrote to memory of 4072 936 RUNDLL32.EXE schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d580ebb6471dbf5a504c7f7e112d6e1.exe"C:\Users\Admin\AppData\Local\Temp\5d580ebb6471dbf5a504c7f7e112d6e1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\5D580E~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\5D580E~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\5D580E~1.DLL,RxssfI0p3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpF4A6.tmp.ps1"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp131D.tmp.ps1"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\system32\nslookup.exe" -type=any localhost5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
47eebe401625bbc55e75dbfb72e9e89a
SHA1db3b2135942d2532c59b9788253638eb77e5995e
SHA256f1cd56000c44bbdb6880b5b133731f493fe8cba8198c5a861da6ae7b489ed0c3
SHA512590b149863d58be346e7927c28501375cc570858d2f156d234b03d68b86c5c0667a1038e2b6f6639172bf95638ca9f7c70f45270951abbcdf43b1be853b81d56
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
10124e8671c68b95d75aeba7dbdc2e32
SHA11fe8782e3ae412776bf2fed52ffc5fa41c10f197
SHA2561c069b52e26d33831ac36c17fcba45b4b1425470e8554ea2074b64f9214f3e1d
SHA51203ffd41419b8a0a234ab3ab267c6c8608d2926951c7b6e567f4fa2c6806dad0d41324dc62956cd2ca0a6fa534157dd131a4d2618e5369648c4391505e5c35ace
-
C:\Users\Admin\AppData\Local\Temp\5D580E~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
C:\Users\Admin\AppData\Local\Temp\tmp131D.tmp.ps1MD5
c7f3b3355c65c34aaca4035f9b5da953
SHA1e1a71c26b6b4541d7db8cfbf33b6f1d7ea91d2f8
SHA2562daf01f3aa8dcc7ba2c9ae80df62d45d595854ccbca57ee22138a4f5235cea1f
SHA51241ecba9d55e025c460a48ce5b7fcbee17a17f46596c413fe9bbc43defeeed82a6619bfea60c8747df0745472013a32cec9694b2beb60e2586ab52fd819e3787c
-
C:\Users\Admin\AppData\Local\Temp\tmp131E.tmpMD5
1860260b2697808b80802352fe324782
SHA1f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b
SHA2560c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1
SHA512d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f
-
C:\Users\Admin\AppData\Local\Temp\tmpF4A6.tmp.ps1MD5
358942a22eeb7cdc5efb336f11cd2616
SHA1dbd9d9f4acb32d8003bad1780b8e49d470ee6135
SHA25690418666032883fd1bd6cda118728bd45461db27be51794d32b3e7655accca7e
SHA512ba72d65aeb1b75636e3850a98cae269be9b5494bd2b8c0d1c7a0df711eb612e47670e1a21cc39b271c440798db9a2c9f11ac5bb25fdd4b866cdccbc34522b22d
-
C:\Users\Admin\AppData\Local\Temp\tmpF4A7.tmpMD5
c416c12d1b2b1da8c8655e393b544362
SHA1fb1a43cd8e1c556c2d25f361f42a21293c29e447
SHA2560600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046
SHA512cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c
-
\Users\Admin\AppData\Local\Temp\5D580E~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\5D580E~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\5D580E~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\5D580E~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
memory/808-114-0x0000000003050000-0x0000000003757000-memory.dmpFilesize
7.0MB
-
memory/808-116-0x0000000000400000-0x0000000000B14000-memory.dmpFilesize
7.1MB
-
memory/808-115-0x0000000000B90000-0x0000000000CDA000-memory.dmpFilesize
1.3MB
-
memory/936-129-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/936-130-0x0000000004F21000-0x0000000005580000-memory.dmpFilesize
6.4MB
-
memory/936-167-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/936-126-0x00000000043D0000-0x0000000004995000-memory.dmpFilesize
5.8MB
-
memory/936-123-0x0000000000000000-mapping.dmp
-
memory/1000-184-0x0000000004B33000-0x0000000004B34000-memory.dmpFilesize
4KB
-
memory/1000-172-0x00000000084D0000-0x00000000084D1000-memory.dmpFilesize
4KB
-
memory/1000-168-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/1000-169-0x0000000004B32000-0x0000000004B33000-memory.dmpFilesize
4KB
-
memory/1000-166-0x0000000008030000-0x0000000008031000-memory.dmpFilesize
4KB
-
memory/1000-157-0x0000000000000000-mapping.dmp
-
memory/2872-185-0x0000000000000000-mapping.dmp
-
memory/2940-127-0x0000000004B51000-0x00000000051B0000-memory.dmpFilesize
6.4MB
-
memory/2940-128-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/2940-117-0x0000000000000000-mapping.dmp
-
memory/2940-121-0x0000000004240000-0x0000000004805000-memory.dmpFilesize
5.8MB
-
memory/2940-122-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/3624-181-0x0000000000000000-mapping.dmp
-
memory/3672-139-0x0000000006D60000-0x0000000006D61000-memory.dmpFilesize
4KB
-
memory/3672-135-0x0000000006F90000-0x0000000006F91000-memory.dmpFilesize
4KB
-
memory/3672-141-0x00000000075C0000-0x00000000075C1000-memory.dmpFilesize
4KB
-
memory/3672-156-0x0000000006953000-0x0000000006954000-memory.dmpFilesize
4KB
-
memory/3672-140-0x0000000006C80000-0x0000000006C81000-memory.dmpFilesize
4KB
-
memory/3672-143-0x0000000007990000-0x0000000007991000-memory.dmpFilesize
4KB
-
memory/3672-138-0x0000000006BE0000-0x0000000006BE1000-memory.dmpFilesize
4KB
-
memory/3672-136-0x0000000006950000-0x0000000006951000-memory.dmpFilesize
4KB
-
memory/3672-137-0x0000000006952000-0x0000000006953000-memory.dmpFilesize
4KB
-
memory/3672-153-0x0000000007DC0000-0x0000000007DC1000-memory.dmpFilesize
4KB
-
memory/3672-134-0x00000000067D0000-0x00000000067D1000-memory.dmpFilesize
4KB
-
memory/3672-131-0x0000000000000000-mapping.dmp
-
memory/3672-152-0x0000000008960000-0x0000000008961000-memory.dmpFilesize
4KB
-
memory/3672-151-0x00000000093C0000-0x00000000093C1000-memory.dmpFilesize
4KB
-
memory/3672-146-0x00000000069F0000-0x00000000069F1000-memory.dmpFilesize
4KB
-
memory/3672-142-0x0000000006CF0000-0x0000000006CF1000-memory.dmpFilesize
4KB
-
memory/3672-144-0x0000000007C60000-0x0000000007C61000-memory.dmpFilesize
4KB
-
memory/4072-186-0x0000000000000000-mapping.dmp