Analysis
-
max time kernel
134s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14-06-2021 17:42
Static task
static1
Behavioral task
behavioral1
Sample
6f5910e79ae771bed168aca6be422a8e.exe
Resource
win7v20210410
General
-
Target
6f5910e79ae771bed168aca6be422a8e.exe
-
Size
6.1MB
-
MD5
6f5910e79ae771bed168aca6be422a8e
-
SHA1
b5eb4fe8c5a47d16b63edaa20a39c5ac17a084ba
-
SHA256
eae0803cd488c0649931c48e816c807dd1c6149a9f975dc68189f600af403114
-
SHA512
8a58a9df6d11275067cba53ce6d28c7b9ef3d62b30768ed04cc3d2460f15404566ed81faafc887de755dbc473330199b985701842ee83aa43cb2b1c46fb17002
Malware Config
Extracted
danabot
1827
3
192.210.198.12:443
37.220.31.50:443
184.95.51.183:443
184.95.51.175:443
-
embedded_hash
410EB249B3A3D8613B29638D583F7193
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
RUNDLL32.EXEflow pid process 12 192 RUNDLL32.EXE 16 192 RUNDLL32.EXE 17 192 RUNDLL32.EXE 18 192 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 2840 rundll32.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 2840 rundll32.exe 2840 rundll32.exe 192 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exeRUNDLL32.EXEdescription pid process Token: SeDebugPrivilege 2840 rundll32.exe Token: SeDebugPrivilege 192 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6f5910e79ae771bed168aca6be422a8e.exerundll32.exedescription pid process target process PID 852 wrote to memory of 2840 852 6f5910e79ae771bed168aca6be422a8e.exe rundll32.exe PID 852 wrote to memory of 2840 852 6f5910e79ae771bed168aca6be422a8e.exe rundll32.exe PID 852 wrote to memory of 2840 852 6f5910e79ae771bed168aca6be422a8e.exe rundll32.exe PID 2840 wrote to memory of 192 2840 rundll32.exe RUNDLL32.EXE PID 2840 wrote to memory of 192 2840 rundll32.exe RUNDLL32.EXE PID 2840 wrote to memory of 192 2840 rundll32.exe RUNDLL32.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f5910e79ae771bed168aca6be422a8e.exe"C:\Users\Admin\AppData\Local\Temp\6f5910e79ae771bed168aca6be422a8e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6F5910~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\6F5910~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\6F5910~1.DLL,MxwXLDYxBQ==3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6F5910~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
\Users\Admin\AppData\Local\Temp\6F5910~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
\Users\Admin\AppData\Local\Temp\6F5910~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
\Users\Admin\AppData\Local\Temp\6F5910~1.DLLMD5
d737e87a8c985246adb399d0a8bf9b3b
SHA12ed4f18c905108e45535ea0e8fa7cb2187675f87
SHA256ab5742f22795a19c1cff270d3d3fef390e43a6a12bba6b69bbe54d479f9502f7
SHA5129257b42d3b4ded392582d72107692d212d46252f218754149882c8faa65aae06881eee8be291f96da43f88f120878faeba23fa3c98f9cf99c9392f702f1a949b
-
memory/192-123-0x0000000000000000-mapping.dmp
-
memory/192-129-0x0000000005141000-0x00000000057A0000-memory.dmpFilesize
6.4MB
-
memory/852-116-0x0000000002DD0000-0x0000000002DD1000-memory.dmpFilesize
4KB
-
memory/852-114-0x0000000003640000-0x0000000003D47000-memory.dmpFilesize
7.0MB
-
memory/852-115-0x0000000000400000-0x00000000011D7000-memory.dmpFilesize
13.8MB
-
memory/2840-117-0x0000000000000000-mapping.dmp
-
memory/2840-121-0x0000000000A30000-0x0000000000FF5000-memory.dmpFilesize
5.8MB
-
memory/2840-122-0x00000000047D0000-0x00000000047D1000-memory.dmpFilesize
4KB
-
memory/2840-127-0x0000000004B91000-0x00000000051F0000-memory.dmpFilesize
6.4MB
-
memory/2840-128-0x0000000001180000-0x0000000001181000-memory.dmpFilesize
4KB