Analysis
-
max time kernel
132s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
09-06-2021 15:15
Static task
static1
Behavioral task
behavioral1
Sample
66c284b62bd5b6640f4478761a690301.exe
Resource
win7v20210410
General
-
Target
66c284b62bd5b6640f4478761a690301.exe
-
Size
6.0MB
-
MD5
66c284b62bd5b6640f4478761a690301
-
SHA1
c1a1d3feed660dc7194869fc2dbc9ae43370fe07
-
SHA256
0e9fb0a524be6d8ff7ca8704b42dcaa025c83247109b5d4e42b1384cf0308f07
-
SHA512
ee4e84d189beec51681573fa3b8d2661a9dd09c68b60f75596eb940bc1b8fd8bd1345f39fc29f93504eb2776317b6a0d1f11be9850215da554904b7152e1e45d
Malware Config
Extracted
danabot
1827
3
184.95.51.175:443
184.95.51.183:443
192.210.198.12:443
37.220.31.52:443
-
embedded_hash
41DB94464223E2DE95BE6AE704AE054E
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
RUNDLL32.EXEflow pid process 13 1976 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 3756 rundll32.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 3756 rundll32.exe 1976 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RUNDLL32.EXEdescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RUNDLL32.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exeRUNDLL32.EXEpowershell.exepid process 3704 powershell.exe 3704 powershell.exe 3704 powershell.exe 1976 RUNDLL32.EXE 1976 RUNDLL32.EXE 2076 powershell.exe 2076 powershell.exe 2076 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3756 rundll32.exe Token: SeDebugPrivilege 1976 RUNDLL32.EXE Token: SeDebugPrivilege 3704 powershell.exe Token: SeDebugPrivilege 2076 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
RUNDLL32.EXEpid process 1976 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
66c284b62bd5b6640f4478761a690301.exerundll32.exeRUNDLL32.EXEpowershell.exedescription pid process target process PID 3896 wrote to memory of 3756 3896 66c284b62bd5b6640f4478761a690301.exe rundll32.exe PID 3896 wrote to memory of 3756 3896 66c284b62bd5b6640f4478761a690301.exe rundll32.exe PID 3896 wrote to memory of 3756 3896 66c284b62bd5b6640f4478761a690301.exe rundll32.exe PID 3756 wrote to memory of 1976 3756 rundll32.exe RUNDLL32.EXE PID 3756 wrote to memory of 1976 3756 rundll32.exe RUNDLL32.EXE PID 3756 wrote to memory of 1976 3756 rundll32.exe RUNDLL32.EXE PID 1976 wrote to memory of 3704 1976 RUNDLL32.EXE powershell.exe PID 1976 wrote to memory of 3704 1976 RUNDLL32.EXE powershell.exe PID 1976 wrote to memory of 3704 1976 RUNDLL32.EXE powershell.exe PID 1976 wrote to memory of 2076 1976 RUNDLL32.EXE powershell.exe PID 1976 wrote to memory of 2076 1976 RUNDLL32.EXE powershell.exe PID 1976 wrote to memory of 2076 1976 RUNDLL32.EXE powershell.exe PID 2076 wrote to memory of 3164 2076 powershell.exe nslookup.exe PID 2076 wrote to memory of 3164 2076 powershell.exe nslookup.exe PID 2076 wrote to memory of 3164 2076 powershell.exe nslookup.exe PID 1976 wrote to memory of 3276 1976 RUNDLL32.EXE schtasks.exe PID 1976 wrote to memory of 3276 1976 RUNDLL32.EXE schtasks.exe PID 1976 wrote to memory of 3276 1976 RUNDLL32.EXE schtasks.exe PID 1976 wrote to memory of 3748 1976 RUNDLL32.EXE schtasks.exe PID 1976 wrote to memory of 3748 1976 RUNDLL32.EXE schtasks.exe PID 1976 wrote to memory of 3748 1976 RUNDLL32.EXE schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66c284b62bd5b6640f4478761a690301.exe"C:\Users\Admin\AppData\Local\Temp\66c284b62bd5b6640f4478761a690301.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\66C284~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\66C284~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\66C284~1.DLL,VwtMZI0=3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp6D56.tmp.ps1"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp7FE6.tmp.ps1"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\system32\nslookup.exe" -type=any localhost5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
47eebe401625bbc55e75dbfb72e9e89a
SHA1db3b2135942d2532c59b9788253638eb77e5995e
SHA256f1cd56000c44bbdb6880b5b133731f493fe8cba8198c5a861da6ae7b489ed0c3
SHA512590b149863d58be346e7927c28501375cc570858d2f156d234b03d68b86c5c0667a1038e2b6f6639172bf95638ca9f7c70f45270951abbcdf43b1be853b81d56
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
a5b6d1d10b18116024d6f83441340fd0
SHA137267ed634d287443249988e9434a1c27d35f0a7
SHA256690c6fd828350cfcd425772bb23eb839d7c7cad3caaf68a0445504ca13ca40e4
SHA512493242c0b319e61d33bd228a7bd82379285284893acdb183bf75221c9625d3baf46849b6c5c1bd68adfc3e4d214952739bfa05df4a890312c78c83cd160d0528
-
C:\Users\Admin\AppData\Local\Temp\66C284~1.DLLMD5
b762d7d76c21c104084249e3a93f79a3
SHA17e2d7325c45630ee7fda7fd1b7de864f8806b1f0
SHA25673058af6661970bb1a8aa52c9f21f0e02462b462aaee99cfd8687e2d0655ded2
SHA512c3d53739d64d29f17645f9a29275b1e7b87f313abc3b963a3bc6a6b066cadd2bd6abc6cc7271339007861131aad6fd93a07b8a44d23ed173369b14720a7b2c46
-
C:\Users\Admin\AppData\Local\Temp\tmp6D56.tmp.ps1MD5
58627467c5a2aef3d8d8378d714dfafa
SHA180bdae92855e4855d9a7ab11d4750718c3ebee45
SHA2564f0de8e825adbe38cc2a775d5f0fa92e74f00fe9a80023c0180ea0fe436c7981
SHA5128dee1abd8188d9718d72082138529ca485ff57f6f855e22fcf2745cf10eab01fc58f44b1222530a3aa9a5d1c91afe28ff068470a3a5d1f35a9f4fbeb3cebbeee
-
C:\Users\Admin\AppData\Local\Temp\tmp6D57.tmpMD5
c416c12d1b2b1da8c8655e393b544362
SHA1fb1a43cd8e1c556c2d25f361f42a21293c29e447
SHA2560600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046
SHA512cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c
-
C:\Users\Admin\AppData\Local\Temp\tmp7FE6.tmp.ps1MD5
f985838f915151a5a2cd7a2fe04e6165
SHA128093772f165afaad633a42d85f2e9e79cbeb48a
SHA256746909d62484467dd5b1e6a13e0b26c11855c8af357f2cc14d2c47d434e50e41
SHA5122b64fb9993bfd3f2ef96a1464d1428c485afe6128e21eb133a57a451f66b339306e25e1cbc01806a874c8686ca625eee2a0e034d2140d36820828b40a313bde5
-
C:\Users\Admin\AppData\Local\Temp\tmp7FE7.tmpMD5
1860260b2697808b80802352fe324782
SHA1f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b
SHA2560c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1
SHA512d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f
-
\Users\Admin\AppData\Local\Temp\66C284~1.DLLMD5
b762d7d76c21c104084249e3a93f79a3
SHA17e2d7325c45630ee7fda7fd1b7de864f8806b1f0
SHA25673058af6661970bb1a8aa52c9f21f0e02462b462aaee99cfd8687e2d0655ded2
SHA512c3d53739d64d29f17645f9a29275b1e7b87f313abc3b963a3bc6a6b066cadd2bd6abc6cc7271339007861131aad6fd93a07b8a44d23ed173369b14720a7b2c46
-
\Users\Admin\AppData\Local\Temp\66C284~1.DLLMD5
b762d7d76c21c104084249e3a93f79a3
SHA17e2d7325c45630ee7fda7fd1b7de864f8806b1f0
SHA25673058af6661970bb1a8aa52c9f21f0e02462b462aaee99cfd8687e2d0655ded2
SHA512c3d53739d64d29f17645f9a29275b1e7b87f313abc3b963a3bc6a6b066cadd2bd6abc6cc7271339007861131aad6fd93a07b8a44d23ed173369b14720a7b2c46
-
memory/1976-168-0x0000000003330000-0x000000000347A000-memory.dmpFilesize
1.3MB
-
memory/1976-128-0x00000000052D1000-0x0000000005930000-memory.dmpFilesize
6.4MB
-
memory/1976-123-0x0000000000000000-mapping.dmp
-
memory/2076-170-0x0000000000D82000-0x0000000000D83000-memory.dmpFilesize
4KB
-
memory/2076-169-0x0000000000D80000-0x0000000000D81000-memory.dmpFilesize
4KB
-
memory/2076-167-0x0000000008520000-0x0000000008521000-memory.dmpFilesize
4KB
-
memory/2076-164-0x0000000007B50000-0x0000000007B51000-memory.dmpFilesize
4KB
-
memory/2076-183-0x0000000000D83000-0x0000000000D84000-memory.dmpFilesize
4KB
-
memory/2076-155-0x0000000000000000-mapping.dmp
-
memory/3164-179-0x0000000000000000-mapping.dmp
-
memory/3276-182-0x0000000000000000-mapping.dmp
-
memory/3704-129-0x0000000000000000-mapping.dmp
-
memory/3704-137-0x0000000007D00000-0x0000000007D01000-memory.dmpFilesize
4KB
-
memory/3704-142-0x0000000008340000-0x0000000008341000-memory.dmpFilesize
4KB
-
memory/3704-140-0x0000000007C60000-0x0000000007C61000-memory.dmpFilesize
4KB
-
memory/3704-144-0x0000000008460000-0x0000000008461000-memory.dmpFilesize
4KB
-
memory/3704-149-0x0000000009BA0000-0x0000000009BA1000-memory.dmpFilesize
4KB
-
memory/3704-150-0x0000000009130000-0x0000000009131000-memory.dmpFilesize
4KB
-
memory/3704-151-0x0000000006F60000-0x0000000006F61000-memory.dmpFilesize
4KB
-
memory/3704-139-0x0000000006E62000-0x0000000006E63000-memory.dmpFilesize
4KB
-
memory/3704-154-0x0000000006E63000-0x0000000006E64000-memory.dmpFilesize
4KB
-
memory/3704-138-0x0000000006E60000-0x0000000006E61000-memory.dmpFilesize
4KB
-
memory/3704-141-0x00000000085E0000-0x00000000085E1000-memory.dmpFilesize
4KB
-
memory/3704-136-0x00000000073C0000-0x00000000073C1000-memory.dmpFilesize
4KB
-
memory/3704-135-0x0000000007AD0000-0x0000000007AD1000-memory.dmpFilesize
4KB
-
memory/3704-134-0x0000000007320000-0x0000000007321000-memory.dmpFilesize
4KB
-
memory/3704-133-0x00000000074A0000-0x00000000074A1000-memory.dmpFilesize
4KB
-
memory/3704-132-0x00000000048D0000-0x00000000048D1000-memory.dmpFilesize
4KB
-
memory/3748-184-0x0000000000000000-mapping.dmp
-
memory/3756-114-0x0000000000000000-mapping.dmp
-
memory/3756-125-0x0000000003330000-0x000000000347A000-memory.dmpFilesize
1.3MB
-
memory/3756-122-0x0000000005391000-0x00000000059F0000-memory.dmpFilesize
6.4MB
-
memory/3896-118-0x0000000000400000-0x0000000000B13000-memory.dmpFilesize
7.1MB
-
memory/3896-119-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/3896-117-0x0000000002DA0000-0x00000000034A6000-memory.dmpFilesize
7.0MB