Analysis
-
max time kernel
138s -
max time network
75s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06-06-2021 07:01
Static task
static1
Behavioral task
behavioral1
Sample
2b53aa4ae25e0a2aa60b1f8094d0d4b1.exe
Resource
win7v20210410
General
-
Target
2b53aa4ae25e0a2aa60b1f8094d0d4b1.exe
-
Size
6.0MB
-
MD5
2b53aa4ae25e0a2aa60b1f8094d0d4b1
-
SHA1
07baf301c60c36b8f8f584bc0965e381116258ca
-
SHA256
f9a4b4cc955f9e3b1154a6f1d425732c5e8785afe6deacfaa378efb9825e9e53
-
SHA512
f618cca0245a29a79f40b9263d6705badb01efc33624912b659de68ac5eef051582296879a7d7a150ca98a1bd374237011580780d2b9130b69514eb4790a50f4
Malware Config
Extracted
danabot
1827
3
184.95.51.183:443
184.95.51.175:443
192.210.198.12:443
184.95.51.180:443
-
embedded_hash
AEF96B4D339B580ABB737F203C2D0F52
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
RUNDLL32.EXEflow pid process 10 2960 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 220 rundll32.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 220 rundll32.exe 2960 RUNDLL32.EXE 2960 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RUNDLL32.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exeRUNDLL32.EXEpowershell.exepid process 1724 powershell.exe 1724 powershell.exe 1724 powershell.exe 2960 RUNDLL32.EXE 2960 RUNDLL32.EXE 204 powershell.exe 204 powershell.exe 204 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 220 rundll32.exe Token: SeDebugPrivilege 2960 RUNDLL32.EXE Token: SeDebugPrivilege 1724 powershell.exe Token: SeDebugPrivilege 204 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
RUNDLL32.EXEpid process 2960 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
2b53aa4ae25e0a2aa60b1f8094d0d4b1.exerundll32.exeRUNDLL32.EXEpowershell.exedescription pid process target process PID 668 wrote to memory of 220 668 2b53aa4ae25e0a2aa60b1f8094d0d4b1.exe rundll32.exe PID 668 wrote to memory of 220 668 2b53aa4ae25e0a2aa60b1f8094d0d4b1.exe rundll32.exe PID 668 wrote to memory of 220 668 2b53aa4ae25e0a2aa60b1f8094d0d4b1.exe rundll32.exe PID 220 wrote to memory of 2960 220 rundll32.exe RUNDLL32.EXE PID 220 wrote to memory of 2960 220 rundll32.exe RUNDLL32.EXE PID 220 wrote to memory of 2960 220 rundll32.exe RUNDLL32.EXE PID 2960 wrote to memory of 1724 2960 RUNDLL32.EXE powershell.exe PID 2960 wrote to memory of 1724 2960 RUNDLL32.EXE powershell.exe PID 2960 wrote to memory of 1724 2960 RUNDLL32.EXE powershell.exe PID 2960 wrote to memory of 204 2960 RUNDLL32.EXE powershell.exe PID 2960 wrote to memory of 204 2960 RUNDLL32.EXE powershell.exe PID 2960 wrote to memory of 204 2960 RUNDLL32.EXE powershell.exe PID 204 wrote to memory of 4092 204 powershell.exe nslookup.exe PID 204 wrote to memory of 4092 204 powershell.exe nslookup.exe PID 204 wrote to memory of 4092 204 powershell.exe nslookup.exe PID 2960 wrote to memory of 2308 2960 RUNDLL32.EXE schtasks.exe PID 2960 wrote to memory of 2308 2960 RUNDLL32.EXE schtasks.exe PID 2960 wrote to memory of 2308 2960 RUNDLL32.EXE schtasks.exe PID 2960 wrote to memory of 2228 2960 RUNDLL32.EXE schtasks.exe PID 2960 wrote to memory of 2228 2960 RUNDLL32.EXE schtasks.exe PID 2960 wrote to memory of 2228 2960 RUNDLL32.EXE schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b53aa4ae25e0a2aa60b1f8094d0d4b1.exe"C:\Users\Admin\AppData\Local\Temp\2b53aa4ae25e0a2aa60b1f8094d0d4b1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2B53AA~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\2B53AA~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\2B53AA~1.DLL,MzEC3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpC171.tmp.ps1"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpDEEE.tmp.ps1"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\system32\nslookup.exe" -type=any localhost5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
47eebe401625bbc55e75dbfb72e9e89a
SHA1db3b2135942d2532c59b9788253638eb77e5995e
SHA256f1cd56000c44bbdb6880b5b133731f493fe8cba8198c5a861da6ae7b489ed0c3
SHA512590b149863d58be346e7927c28501375cc570858d2f156d234b03d68b86c5c0667a1038e2b6f6639172bf95638ca9f7c70f45270951abbcdf43b1be853b81d56
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
e4d08aaafdb6bc1313134dc767a7ed86
SHA1c48254ee5057549d5c92d26fe9f56d766eb2d34a
SHA2568749867340a0707e769b8c09b6f2b99264c51b412aac587a704d6084c453a4bd
SHA5128dfa1bfa63131ff898bc68ede367d67b01fa392e3bcb0d52adf103fd98e81bac9bec9625daff818fa9658e299b4962a2e8922e762a8e5f583e8a1cfc972edabb
-
C:\Users\Admin\AppData\Local\Temp\2B53AA~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
C:\Users\Admin\AppData\Local\Temp\tmpC171.tmp.ps1MD5
f024da5cddd8a29a17d8bb60437f940f
SHA1e58982b80a737c98f88e0b9b59c7affa02306112
SHA256e574d1b2437534c67a3d83b4c5ddac039dc90f1ad1867815c9113962d495d782
SHA512ce8a990a03e1913ffc3451559a448e0f760d64b3bd4e829e6339ec8f4d11ad3af2efbb8951dd4666ce72bf15a457ce4f74e6c3a4fe8d152233f2bd59a9986cb7
-
C:\Users\Admin\AppData\Local\Temp\tmpC172.tmpMD5
c416c12d1b2b1da8c8655e393b544362
SHA1fb1a43cd8e1c556c2d25f361f42a21293c29e447
SHA2560600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046
SHA512cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c
-
C:\Users\Admin\AppData\Local\Temp\tmpDEEE.tmp.ps1MD5
e8415ebc357171d4bea76ae2bb8ad7fe
SHA10c9f26954b4d2bf8678242cf9f03f14931eb7e78
SHA2560fae71b22e4539187a9c7b849b4ad08c05c88d1ff9969151cdbcddea10215850
SHA5127bb5867f1ed8e8ada37adf517e26058a4fd0e1d75b9bda498b3a0f0ec2ed123f6ad4fd102e4b822878d3367a3319a6cf7e8c8502d8fdc9b1ede5c33fa0b20b4b
-
C:\Users\Admin\AppData\Local\Temp\tmpDEEF.tmpMD5
1860260b2697808b80802352fe324782
SHA1f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b
SHA2560c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1
SHA512d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f
-
\Users\Admin\AppData\Local\Temp\2B53AA~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\2B53AA~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
\Users\Admin\AppData\Local\Temp\2B53AA~1.DLLMD5
7ac078a4c0a0c82464f31418b512cad7
SHA1edafdb4391106484521c3a76890690ee525a9d68
SHA2568c8d6d7a1c6ce3ae445a85b32aac61eef74d00effcaaac0379d33cd299008418
SHA512e5c6cff838a20a0130ed42b170fdd0fcca3491dd65ffb4ced4612b8c8598b3083172f3218a5471c22ffdd6189f748c22e6c7b9417a775344b04956fa2e141507
-
memory/204-168-0x0000000006900000-0x0000000006901000-memory.dmpFilesize
4KB
-
memory/204-169-0x0000000006902000-0x0000000006903000-memory.dmpFilesize
4KB
-
memory/204-165-0x00000000079B0000-0x00000000079B1000-memory.dmpFilesize
4KB
-
memory/204-171-0x0000000008390000-0x0000000008391000-memory.dmpFilesize
4KB
-
memory/204-156-0x0000000000000000-mapping.dmp
-
memory/204-184-0x0000000006903000-0x0000000006904000-memory.dmpFilesize
4KB
-
memory/220-127-0x0000000001080000-0x00000000011CA000-memory.dmpFilesize
1.3MB
-
memory/220-117-0x0000000000000000-mapping.dmp
-
memory/220-126-0x0000000005341000-0x00000000059A0000-memory.dmpFilesize
6.4MB
-
memory/668-114-0x0000000003030000-0x0000000003737000-memory.dmpFilesize
7.0MB
-
memory/668-116-0x0000000002850000-0x0000000002851000-memory.dmpFilesize
4KB
-
memory/668-115-0x0000000000400000-0x0000000000B14000-memory.dmpFilesize
7.1MB
-
memory/1724-142-0x0000000007B60000-0x0000000007B61000-memory.dmpFilesize
4KB
-
memory/1724-138-0x0000000007A50000-0x0000000007A51000-memory.dmpFilesize
4KB
-
memory/1724-135-0x0000000007220000-0x0000000007221000-memory.dmpFilesize
4KB
-
memory/1724-143-0x00000000083E0000-0x00000000083E1000-memory.dmpFilesize
4KB
-
memory/1724-134-0x00000000073B0000-0x00000000073B1000-memory.dmpFilesize
4KB
-
memory/1724-145-0x00000000084F0000-0x00000000084F1000-memory.dmpFilesize
4KB
-
memory/1724-150-0x0000000009B60000-0x0000000009B61000-memory.dmpFilesize
4KB
-
memory/1724-151-0x00000000090F0000-0x00000000090F1000-memory.dmpFilesize
4KB
-
memory/1724-152-0x00000000093C0000-0x00000000093C1000-memory.dmpFilesize
4KB
-
memory/1724-153-0x0000000004953000-0x0000000004954000-memory.dmpFilesize
4KB
-
memory/1724-133-0x00000000048C0000-0x00000000048C1000-memory.dmpFilesize
4KB
-
memory/1724-130-0x0000000000000000-mapping.dmp
-
memory/1724-136-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/1724-137-0x0000000004952000-0x0000000004953000-memory.dmpFilesize
4KB
-
memory/1724-140-0x0000000007D10000-0x0000000007D11000-memory.dmpFilesize
4KB
-
memory/1724-141-0x0000000007B30000-0x0000000007B31000-memory.dmpFilesize
4KB
-
memory/1724-139-0x0000000007AC0000-0x0000000007AC1000-memory.dmpFilesize
4KB
-
memory/2228-185-0x0000000000000000-mapping.dmp
-
memory/2308-183-0x0000000000000000-mapping.dmp
-
memory/2960-125-0x0000000000BA0000-0x0000000001165000-memory.dmpFilesize
5.8MB
-
memory/2960-122-0x0000000000000000-mapping.dmp
-
memory/2960-167-0x00000000006B0000-0x00000000006B1000-memory.dmpFilesize
4KB
-
memory/2960-128-0x00000000012F0000-0x00000000012F1000-memory.dmpFilesize
4KB
-
memory/2960-129-0x0000000004C41000-0x00000000052A0000-memory.dmpFilesize
6.4MB
-
memory/4092-180-0x0000000000000000-mapping.dmp