Analysis
-
max time kernel
131s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
09-06-2021 16:06
Static task
static1
Behavioral task
behavioral1
Sample
66c284b62bd5b6640f4478761a690301.exe
Resource
win7v20210410
General
-
Target
66c284b62bd5b6640f4478761a690301.exe
-
Size
6.0MB
-
MD5
66c284b62bd5b6640f4478761a690301
-
SHA1
c1a1d3feed660dc7194869fc2dbc9ae43370fe07
-
SHA256
0e9fb0a524be6d8ff7ca8704b42dcaa025c83247109b5d4e42b1384cf0308f07
-
SHA512
ee4e84d189beec51681573fa3b8d2661a9dd09c68b60f75596eb940bc1b8fd8bd1345f39fc29f93504eb2776317b6a0d1f11be9850215da554904b7152e1e45d
Malware Config
Extracted
danabot
1827
3
184.95.51.175:443
184.95.51.183:443
192.210.198.12:443
37.220.31.52:443
-
embedded_hash
41DB94464223E2DE95BE6AE704AE054E
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
RUNDLL32.EXEflow pid process 12 1956 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 1328 rundll32.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 1328 rundll32.exe 1956 RUNDLL32.EXE 1956 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RUNDLL32.EXEdescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RUNDLL32.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exeRUNDLL32.EXEpowershell.exepid process 1740 powershell.exe 1740 powershell.exe 1740 powershell.exe 1956 RUNDLL32.EXE 1956 RUNDLL32.EXE 204 powershell.exe 204 powershell.exe 204 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1328 rundll32.exe Token: SeDebugPrivilege 1956 RUNDLL32.EXE Token: SeDebugPrivilege 1740 powershell.exe Token: SeDebugPrivilege 204 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
RUNDLL32.EXEpid process 1956 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
66c284b62bd5b6640f4478761a690301.exerundll32.exeRUNDLL32.EXEpowershell.exedescription pid process target process PID 3872 wrote to memory of 1328 3872 66c284b62bd5b6640f4478761a690301.exe rundll32.exe PID 3872 wrote to memory of 1328 3872 66c284b62bd5b6640f4478761a690301.exe rundll32.exe PID 3872 wrote to memory of 1328 3872 66c284b62bd5b6640f4478761a690301.exe rundll32.exe PID 1328 wrote to memory of 1956 1328 rundll32.exe RUNDLL32.EXE PID 1328 wrote to memory of 1956 1328 rundll32.exe RUNDLL32.EXE PID 1328 wrote to memory of 1956 1328 rundll32.exe RUNDLL32.EXE PID 1956 wrote to memory of 1740 1956 RUNDLL32.EXE powershell.exe PID 1956 wrote to memory of 1740 1956 RUNDLL32.EXE powershell.exe PID 1956 wrote to memory of 1740 1956 RUNDLL32.EXE powershell.exe PID 1956 wrote to memory of 204 1956 RUNDLL32.EXE powershell.exe PID 1956 wrote to memory of 204 1956 RUNDLL32.EXE powershell.exe PID 1956 wrote to memory of 204 1956 RUNDLL32.EXE powershell.exe PID 204 wrote to memory of 3692 204 powershell.exe nslookup.exe PID 204 wrote to memory of 3692 204 powershell.exe nslookup.exe PID 204 wrote to memory of 3692 204 powershell.exe nslookup.exe PID 1956 wrote to memory of 3156 1956 RUNDLL32.EXE schtasks.exe PID 1956 wrote to memory of 3156 1956 RUNDLL32.EXE schtasks.exe PID 1956 wrote to memory of 3156 1956 RUNDLL32.EXE schtasks.exe PID 1956 wrote to memory of 1340 1956 RUNDLL32.EXE schtasks.exe PID 1956 wrote to memory of 1340 1956 RUNDLL32.EXE schtasks.exe PID 1956 wrote to memory of 1340 1956 RUNDLL32.EXE schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66c284b62bd5b6640f4478761a690301.exe"C:\Users\Admin\AppData\Local\Temp\66c284b62bd5b6640f4478761a690301.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\66C284~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\66C284~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\66C284~1.DLL,HhENfI2t3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp9AAF.tmp.ps1"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpAC36.tmp.ps1"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\system32\nslookup.exe" -type=any localhost5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
47eebe401625bbc55e75dbfb72e9e89a
SHA1db3b2135942d2532c59b9788253638eb77e5995e
SHA256f1cd56000c44bbdb6880b5b133731f493fe8cba8198c5a861da6ae7b489ed0c3
SHA512590b149863d58be346e7927c28501375cc570858d2f156d234b03d68b86c5c0667a1038e2b6f6639172bf95638ca9f7c70f45270951abbcdf43b1be853b81d56
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
3d1f0d1dc10c11768d28cf8c1a455cea
SHA120ef2fd1f5e2ed3f93ba9eaaf93d61f6ab632522
SHA25616e050df912d930e5e0c9141656833331b53540bd0a6569e85991ac6af1212b1
SHA512b6c5ac27741c6384b7995c17e026f956bca015c9806bf00c58610297853266c5b3d2d3cc44ae3ae50ca392b5fbd5a3c34440d0e8cc436a16a9fef80f582ad2b8
-
C:\Users\Admin\AppData\Local\Temp\66C284~1.DLLMD5
b762d7d76c21c104084249e3a93f79a3
SHA17e2d7325c45630ee7fda7fd1b7de864f8806b1f0
SHA25673058af6661970bb1a8aa52c9f21f0e02462b462aaee99cfd8687e2d0655ded2
SHA512c3d53739d64d29f17645f9a29275b1e7b87f313abc3b963a3bc6a6b066cadd2bd6abc6cc7271339007861131aad6fd93a07b8a44d23ed173369b14720a7b2c46
-
C:\Users\Admin\AppData\Local\Temp\tmp9AAF.tmp.ps1MD5
8a1e27d6078ca7f78d6e1799cf748d41
SHA1b47d452090b4d360c22f12bc30a8eabb872edbeb
SHA2568a6cf219cdf432cf2a264ef05b6df8771d7797f4fc2d5b7a4eafe39bee194915
SHA512ff2bae190341d5ec5586c1f4503438c7818fd4f88a308b4e1c32e4fde40a72523410c55e33914919b499204ca71b0dbaabe98ca8dfa6791adadc4777a930275c
-
C:\Users\Admin\AppData\Local\Temp\tmp9AB0.tmpMD5
c416c12d1b2b1da8c8655e393b544362
SHA1fb1a43cd8e1c556c2d25f361f42a21293c29e447
SHA2560600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046
SHA512cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c
-
C:\Users\Admin\AppData\Local\Temp\tmpAC36.tmp.ps1MD5
c05d21fba73f401c1a0315c02b018946
SHA1824fa620f7523740c0a30ff8d3211cb8636b5b2c
SHA256e24d2b72d3e0b866731323d8f9ba79d74649cfb3017260dfd47cdcffc89d7ea4
SHA512739abd90e0e562a9dd60652f68357d8328a67791cf2e9635f3bfcb2c762ff74819091e6b2a54c19d97c239c9a8e191e2cc591a3cf2eb1fa69a25f78fde6fd900
-
C:\Users\Admin\AppData\Local\Temp\tmpAC37.tmpMD5
1860260b2697808b80802352fe324782
SHA1f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b
SHA2560c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1
SHA512d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f
-
\Users\Admin\AppData\Local\Temp\66C284~1.DLLMD5
b762d7d76c21c104084249e3a93f79a3
SHA17e2d7325c45630ee7fda7fd1b7de864f8806b1f0
SHA25673058af6661970bb1a8aa52c9f21f0e02462b462aaee99cfd8687e2d0655ded2
SHA512c3d53739d64d29f17645f9a29275b1e7b87f313abc3b963a3bc6a6b066cadd2bd6abc6cc7271339007861131aad6fd93a07b8a44d23ed173369b14720a7b2c46
-
\Users\Admin\AppData\Local\Temp\66C284~1.DLLMD5
b762d7d76c21c104084249e3a93f79a3
SHA17e2d7325c45630ee7fda7fd1b7de864f8806b1f0
SHA25673058af6661970bb1a8aa52c9f21f0e02462b462aaee99cfd8687e2d0655ded2
SHA512c3d53739d64d29f17645f9a29275b1e7b87f313abc3b963a3bc6a6b066cadd2bd6abc6cc7271339007861131aad6fd93a07b8a44d23ed173369b14720a7b2c46
-
\Users\Admin\AppData\Local\Temp\66C284~1.DLLMD5
b762d7d76c21c104084249e3a93f79a3
SHA17e2d7325c45630ee7fda7fd1b7de864f8806b1f0
SHA25673058af6661970bb1a8aa52c9f21f0e02462b462aaee99cfd8687e2d0655ded2
SHA512c3d53739d64d29f17645f9a29275b1e7b87f313abc3b963a3bc6a6b066cadd2bd6abc6cc7271339007861131aad6fd93a07b8a44d23ed173369b14720a7b2c46
-
memory/204-192-0x0000000007453000-0x0000000007454000-memory.dmpFilesize
4KB
-
memory/204-179-0x0000000008C10000-0x0000000008C11000-memory.dmpFilesize
4KB
-
memory/204-176-0x0000000008290000-0x0000000008291000-memory.dmpFilesize
4KB
-
memory/204-171-0x0000000007452000-0x0000000007453000-memory.dmpFilesize
4KB
-
memory/204-169-0x0000000007450000-0x0000000007451000-memory.dmpFilesize
4KB
-
memory/204-163-0x0000000000000000-mapping.dmp
-
memory/1328-136-0x0000000003310000-0x0000000003311000-memory.dmpFilesize
4KB
-
memory/1328-124-0x00000000052D1000-0x0000000005930000-memory.dmpFilesize
6.4MB
-
memory/1328-115-0x0000000000000000-mapping.dmp
-
memory/1340-193-0x0000000000000000-mapping.dmp
-
memory/1740-148-0x0000000008270000-0x0000000008271000-memory.dmpFilesize
4KB
-
memory/1740-143-0x00000000073B0000-0x00000000073B1000-memory.dmpFilesize
4KB
-
memory/1740-138-0x0000000000000000-mapping.dmp
-
memory/1740-149-0x0000000008040000-0x0000000008041000-memory.dmpFilesize
4KB
-
memory/1740-150-0x00000000086C0000-0x00000000086C1000-memory.dmpFilesize
4KB
-
memory/1740-151-0x0000000008920000-0x0000000008921000-memory.dmpFilesize
4KB
-
memory/1740-146-0x0000000008090000-0x0000000008091000-memory.dmpFilesize
4KB
-
memory/1740-153-0x0000000008A40000-0x0000000008A41000-memory.dmpFilesize
4KB
-
memory/1740-158-0x000000000A150000-0x000000000A151000-memory.dmpFilesize
4KB
-
memory/1740-159-0x00000000096D0000-0x00000000096D1000-memory.dmpFilesize
4KB
-
memory/1740-160-0x00000000074E0000-0x00000000074E1000-memory.dmpFilesize
4KB
-
memory/1740-145-0x00000000078D0000-0x00000000078D1000-memory.dmpFilesize
4KB
-
memory/1740-144-0x00000000073B2000-0x00000000073B3000-memory.dmpFilesize
4KB
-
memory/1740-147-0x0000000008200000-0x0000000008201000-memory.dmpFilesize
4KB
-
memory/1740-167-0x00000000073B3000-0x00000000073B4000-memory.dmpFilesize
4KB
-
memory/1740-142-0x00000000079F0000-0x00000000079F1000-memory.dmpFilesize
4KB
-
memory/1740-141-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/1956-172-0x0000000000480000-0x0000000000481000-memory.dmpFilesize
4KB
-
memory/1956-137-0x0000000004C01000-0x0000000005260000-memory.dmpFilesize
6.4MB
-
memory/1956-131-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/1956-130-0x0000000004010000-0x00000000045D4000-memory.dmpFilesize
5.8MB
-
memory/1956-127-0x0000000000000000-mapping.dmp
-
memory/3156-191-0x0000000000000000-mapping.dmp
-
memory/3692-188-0x0000000000000000-mapping.dmp
-
memory/3872-114-0x0000000002F60000-0x0000000003666000-memory.dmpFilesize
7.0MB
-
memory/3872-119-0x0000000000B20000-0x0000000000C6A000-memory.dmpFilesize
1.3MB
-
memory/3872-118-0x0000000000400000-0x0000000000B13000-memory.dmpFilesize
7.1MB