Analysis
-
max time kernel
136s -
max time network
155s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13-06-2021 11:24
Static task
static1
Behavioral task
behavioral1
Sample
0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exe
Resource
win7v20210408
General
-
Target
0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exe
-
Size
6.0MB
-
MD5
7a43be00bb3ff76da6c777999b1c4f3a
-
SHA1
ef82fd1f589eeadb54bd249d93c6370370924fc4
-
SHA256
0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85
-
SHA512
44b3c591289936de5c6fbe23f2fbad2de84b7406fa1ce861648cf8bf6c73d8dadd46c03676819ade9718e0cfa601d051a952c3cd9c89d4390b01605c57d52134
Malware Config
Extracted
danabot
1827
3
192.210.198.12:443
37.220.31.50:443
184.95.51.183:443
184.95.51.175:443
-
embedded_hash
410EB249B3A3D8613B29638D583F7193
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
RUNDLL32.EXEflow pid process 5 664 RUNDLL32.EXE 6 664 RUNDLL32.EXE 7 664 RUNDLL32.EXE 8 664 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 756 rundll32.exe -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 756 rundll32.exe 756 rundll32.exe 756 rundll32.exe 756 rundll32.exe 664 RUNDLL32.EXE 664 RUNDLL32.EXE 664 RUNDLL32.EXE 664 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 8 IoCs
Processes:
RUNDLL32.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P8HHGB03\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HNHPAZTY\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini RUNDLL32.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exeRUNDLL32.EXEdescription pid process Token: SeDebugPrivilege 756 rundll32.exe Token: SeDebugPrivilege 664 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exerundll32.exedescription pid process target process PID 1944 wrote to memory of 756 1944 0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exe rundll32.exe PID 1944 wrote to memory of 756 1944 0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exe rundll32.exe PID 1944 wrote to memory of 756 1944 0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exe rundll32.exe PID 1944 wrote to memory of 756 1944 0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exe rundll32.exe PID 1944 wrote to memory of 756 1944 0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exe rundll32.exe PID 1944 wrote to memory of 756 1944 0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exe rundll32.exe PID 1944 wrote to memory of 756 1944 0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exe rundll32.exe PID 756 wrote to memory of 664 756 rundll32.exe RUNDLL32.EXE PID 756 wrote to memory of 664 756 rundll32.exe RUNDLL32.EXE PID 756 wrote to memory of 664 756 rundll32.exe RUNDLL32.EXE PID 756 wrote to memory of 664 756 rundll32.exe RUNDLL32.EXE PID 756 wrote to memory of 664 756 rundll32.exe RUNDLL32.EXE PID 756 wrote to memory of 664 756 rundll32.exe RUNDLL32.EXE PID 756 wrote to memory of 664 756 rundll32.exe RUNDLL32.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exe"C:\Users\Admin\AppData\Local\Temp\0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\0576A0~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\0576A0~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\0576A0~1.DLL,GwEaNJ8H3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0576A0~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
\Users\Admin\AppData\Local\Temp\0576A0~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
\Users\Admin\AppData\Local\Temp\0576A0~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
\Users\Admin\AppData\Local\Temp\0576A0~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
\Users\Admin\AppData\Local\Temp\0576A0~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
\Users\Admin\AppData\Local\Temp\0576A0~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
\Users\Admin\AppData\Local\Temp\0576A0~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
\Users\Admin\AppData\Local\Temp\0576A0~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
\Users\Admin\AppData\Local\Temp\0576A0~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
memory/664-78-0x0000000001EA0000-0x0000000002465000-memory.dmpFilesize
5.8MB
-
memory/664-72-0x0000000000000000-mapping.dmp
-
memory/664-81-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/664-82-0x0000000002A51000-0x00000000030B0000-memory.dmpFilesize
6.4MB
-
memory/756-63-0x0000000000000000-mapping.dmp
-
memory/756-70-0x0000000001FB0000-0x0000000002575000-memory.dmpFilesize
5.8MB
-
memory/756-71-0x00000000030E0000-0x00000000030E1000-memory.dmpFilesize
4KB
-
memory/756-79-0x0000000002931000-0x0000000002F90000-memory.dmpFilesize
6.4MB
-
memory/756-80-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1944-59-0x0000000076691000-0x0000000076693000-memory.dmpFilesize
8KB
-
memory/1944-62-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1944-60-0x0000000002A90000-0x0000000003197000-memory.dmpFilesize
7.0MB
-
memory/1944-61-0x0000000000400000-0x0000000000B13000-memory.dmpFilesize
7.1MB