danabot | c97d5d2645cc3028888156c99ddec9d67c3eb8812295d6f2fdd3f6e1a182f9a3

Analysis

max time kernel
145s
max time network
130s
platform
windows10_x64
resource
win10v20210410
submitted
23-07-2021 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6a8f833fdd0b5f4ee7b46714a3d20c7.exe
Size

482KB
MD5

a6a8f833fdd0b5f4ee7b46714a3d20c7
SHA1

bb056be49140db02baa6b03618d0fa4fdc14ea0f
SHA256

c97d5d2645cc3028888156c99ddec9d67c3eb8812295d6f2fdd3f6e1a182f9a3
SHA512

d237d4e6d17c31a19a633c88c11b47e63fcb9fee386ab1772103e068cf59c56ac2676184e17e612b1dc345b69643d65fa89ddcb7ea87dab8d593eb6867cc10aa

Score

10^/10

danabot 4 banker discovery spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1987

Botnet

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB

rsa_privkey.plain

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 6 IoCs

Processes:

WScript.exerundll32.exeRUNDLL32.EXE

flow pid process

31 3420 WScript.exe
33 3420 WScript.exe
35 3420 WScript.exe
37 3420 WScript.exe
40 2656 rundll32.exe
41 2840 RUNDLL32.EXE
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

4.exevpn.exeSmartClock.exeevsabapfenod.exe

pid process

2668 4.exe
2744 vpn.exe
60 SmartClock.exe
3308 evsabapfenod.exe
Drops startup file 1 IoCs

Processes:

4.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 4.exe
Loads dropped DLL 3 IoCs

Processes:

a6a8f833fdd0b5f4ee7b46714a3d20c7.exerundll32.exeRUNDLL32.EXE

pid process

3944 a6a8f833fdd0b5f4ee7b46714a3d20c7.exe
2656 rundll32.exe
2840 RUNDLL32.EXE
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ip-api.com

flow	pid	process
31	3420	WScript.exe
33	3420	WScript.exe
35	3420	WScript.exe
37	3420	WScript.exe
40	2656	rundll32.exe
41	2840	RUNDLL32.EXE

pid	process
2668	4.exe
2744	vpn.exe
60	SmartClock.exe
3308	evsabapfenod.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	4.exe

pid	process
3944	a6a8f833fdd0b5f4ee7b46714a3d20c7.exe
2656	rundll32.exe
2840	RUNDLL32.EXE

flow	ioc
10	ip-api.com

Drops file in Program Files directory 4 IoCs

Processes:

a6a8f833fdd0b5f4ee7b46714a3d20c7.exerundll32.exe

description	ioc	process
File created	C:\Program Files (x86)\foler\olader\acppage.dll	a6a8f833fdd0b5f4ee7b46714a3d20c7.exe
File created	C:\Program Files (x86)\foler\olader\adprovider.dll	a6a8f833fdd0b5f4ee7b46714a3d20c7.exe
File created	C:\Program Files (x86)\foler\olader\acledit.dll	a6a8f833fdd0b5f4ee7b46714a3d20c7.exe
File created	C:\PROGRA~3\Jvgzbfh.tmp	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

vpn.exeRUNDLL32.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vpn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vpn.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	RUNDLL32.EXE

Modifies registry class 1 IoCs

Processes:

vpn.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings vpn.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	vpn.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

WScript.exeRUNDLL32.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C1192DE920B8F1C18AA545629CB7082858126E29	RUNDLL32.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C1192DE920B8F1C18AA545629CB7082858126E29\Blob = 030000000100000014000000c1192de920b8f1c18aa545629cb7082858126e2920000000010000006d02000030820269308201d2a003020102020864f43db86a9cb2e8300d06092a864886f70d01010b050030513133303106035504030c2a4d693663726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479310d300b060355040a0c044d534654310b3009060355040613025553301e170d3139303732343036323731315a170d3233303732333036323731315a30513133303106035504030c2a4d693663726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479310d300b060355040a0c044d534654310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100dcc7055b953e175233ae4493726197f26a6ec18faf34097abd9567a238fdf9d9286a99563195cd7cc81eba5429a9014ca7ececfdd478ccc99cefe8a44389ece1929edf217245676b17931d4ca5215e9ca370bf3e74fa3459ae004c404d9dd696b186f04ab3c00722555030c0d38aea2a81739a025212ee280cfa355d69171f4b0203010001a34a3048300f0603551d130101ff040530030101ff30350603551d11042e302c822a4d693663726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479300d06092a864886f70d01010b050003818100ac32c7e8686a29aa5ffd351684df8bc014475197b900b6276519fefa970c4f9a33568dedbc20fe0ab5195f86c4c0b6fa81fa2f252f6b14965d815e89b82c8835fd152e4470e7b782f657806e5072e6881a191ffad056db4a999e36d5ee0168f8d167579aa7b68597112945eb3a60798df6d6e8c9c248cbb1cd9ed39163731866	RUNDLL32.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

SmartClock.exe

pid process

60 SmartClock.exe

pid	process
60	SmartClock.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

RUNDLL32.EXEpowershell.exepowershell.exe

pid	process
2840	RUNDLL32.EXE
2840	RUNDLL32.EXE
2840	RUNDLL32.EXE
2840	RUNDLL32.EXE
2840	RUNDLL32.EXE
2840	RUNDLL32.EXE
3808	powershell.exe
3808	powershell.exe
3808	powershell.exe
2840	RUNDLL32.EXE
2840	RUNDLL32.EXE
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

RUNDLL32.EXEpowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2840 RUNDLL32.EXE
Token: SeDebugPrivilege 3808 powershell.exe
Token: SeDebugPrivilege 2172 powershell.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

RUNDLL32.EXE

pid process

2840 RUNDLL32.EXE

description	pid	process
Token: SeDebugPrivilege	2840	RUNDLL32.EXE
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

a6a8f833fdd0b5f4ee7b46714a3d20c7.exe4.exevpn.exeevsabapfenod.exerundll32.exeRUNDLL32.EXEpowershell.exe

description	pid	process	target process
PID 3944 wrote to memory of 2668	3944	a6a8f833fdd0b5f4ee7b46714a3d20c7.exe	4.exe
PID 3944 wrote to memory of 2668	3944	a6a8f833fdd0b5f4ee7b46714a3d20c7.exe	4.exe
PID 3944 wrote to memory of 2668	3944	a6a8f833fdd0b5f4ee7b46714a3d20c7.exe	4.exe
PID 3944 wrote to memory of 2744	3944	a6a8f833fdd0b5f4ee7b46714a3d20c7.exe	vpn.exe
PID 3944 wrote to memory of 2744	3944	a6a8f833fdd0b5f4ee7b46714a3d20c7.exe	vpn.exe
PID 3944 wrote to memory of 2744	3944	a6a8f833fdd0b5f4ee7b46714a3d20c7.exe	vpn.exe
PID 2668 wrote to memory of 60	2668	4.exe	SmartClock.exe
PID 2668 wrote to memory of 60	2668	4.exe	SmartClock.exe
PID 2668 wrote to memory of 60	2668	4.exe	SmartClock.exe
PID 2744 wrote to memory of 3308	2744	vpn.exe	evsabapfenod.exe
PID 2744 wrote to memory of 3308	2744	vpn.exe	evsabapfenod.exe
PID 2744 wrote to memory of 3308	2744	vpn.exe	evsabapfenod.exe
PID 2744 wrote to memory of 1104	2744	vpn.exe	WScript.exe
PID 2744 wrote to memory of 1104	2744	vpn.exe	WScript.exe
PID 2744 wrote to memory of 1104	2744	vpn.exe	WScript.exe
PID 3308 wrote to memory of 2656	3308	evsabapfenod.exe	rundll32.exe
PID 3308 wrote to memory of 2656	3308	evsabapfenod.exe	rundll32.exe
PID 3308 wrote to memory of 2656	3308	evsabapfenod.exe	rundll32.exe
PID 2744 wrote to memory of 3420	2744	vpn.exe	WScript.exe
PID 2744 wrote to memory of 3420	2744	vpn.exe	WScript.exe
PID 2744 wrote to memory of 3420	2744	vpn.exe	WScript.exe
PID 2656 wrote to memory of 2840	2656	rundll32.exe	RUNDLL32.EXE
PID 2656 wrote to memory of 2840	2656	rundll32.exe	RUNDLL32.EXE
PID 2656 wrote to memory of 2840	2656	rundll32.exe	RUNDLL32.EXE
PID 2840 wrote to memory of 3808	2840	RUNDLL32.EXE	powershell.exe
PID 2840 wrote to memory of 3808	2840	RUNDLL32.EXE	powershell.exe
PID 2840 wrote to memory of 3808	2840	RUNDLL32.EXE	powershell.exe
PID 2840 wrote to memory of 2172	2840	RUNDLL32.EXE	powershell.exe
PID 2840 wrote to memory of 2172	2840	RUNDLL32.EXE	powershell.exe
PID 2840 wrote to memory of 2172	2840	RUNDLL32.EXE	powershell.exe
PID 2172 wrote to memory of 3828	2172	powershell.exe	nslookup.exe
PID 2172 wrote to memory of 3828	2172	powershell.exe	nslookup.exe
PID 2172 wrote to memory of 3828	2172	powershell.exe	nslookup.exe
PID 2840 wrote to memory of 3896	2840	RUNDLL32.EXE	schtasks.exe
PID 2840 wrote to memory of 3896	2840	RUNDLL32.EXE	schtasks.exe
PID 2840 wrote to memory of 3896	2840	RUNDLL32.EXE	schtasks.exe
PID 2840 wrote to memory of 348	2840	RUNDLL32.EXE	schtasks.exe
PID 2840 wrote to memory of 348	2840	RUNDLL32.EXE	schtasks.exe
PID 2840 wrote to memory of 348	2840	RUNDLL32.EXE	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\a6a8f833fdd0b5f4ee7b46714a3d20c7.exe
"C:\Users\Admin\AppData\Local\Temp\a6a8f833fdd0b5f4ee7b46714a3d20c7.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3944

C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
"C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2668

C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:60

C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
"C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2744

C:\Users\Admin\AppData\Local\Temp\evsabapfenod.exe
"C:\Users\Admin\AppData\Local\Temp\evsabapfenod.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\EVSABA~1.TMP,S C:\Users\Admin\AppData\Local\Temp\EVSABA~1.EXE
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\EVSABA~1.TMP,JA0XNUs1
5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp704F.tmp.ps1"
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp8168.tmp.ps1"
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\SysWOW64\nslookup.exe
"C:\Windows\system32\nslookup.exe" -type=any localhost
7⤵
PID:3828

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
6⤵
PID:3896

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
6⤵
PID:348

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xyrjgrdgdwd.vbs"
3⤵
PID:1104

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\lhypardfjahw.vbs"
3⤵
- Blocklisted process makes network request
- Modifies system certificate store
PID:3420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Jvgzbfh.tmp
MD5
28af8cb2774479463f175bc7b7635092

SHA1
a870d7de7f76cd66e7716b3ef4af412aae0a7a63

SHA256
bcacc0f1afb24b1f902acc8caae2679c850ce8c3e08daaff51d6ebfe70d969c1

SHA512
ac69eb7993fd5cd15ed4b96a0220c86dfb629e7029021804b01569d0290572b834834b6a577c350d0d3e93f8615713e002622eea3f43ae24e4753e96435e7c6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
47eebe401625bbc55e75dbfb72e9e89a

SHA1
db3b2135942d2532c59b9788253638eb77e5995e

SHA256
f1cd56000c44bbdb6880b5b133731f493fe8cba8198c5a861da6ae7b489ed0c3

SHA512
590b149863d58be346e7927c28501375cc570858d2f156d234b03d68b86c5c0667a1038e2b6f6639172bf95638ca9f7c70f45270951abbcdf43b1be853b81d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
fe15dd3c64b536fa5adb324c051f0178

SHA1
b3597afc0fa74ea792eac7d17193aa2880cc0fb5

SHA256
d405fea269992b0844c4bae6443163f8429fc822b565d3f0c82797e7ec21bc8f

SHA512
12789d0f5d7032a40d774d23d2ae0a1dc1fd74868537c3f9e493b0a9bd4a548cf78a9c011988cbf2fb729af092a994297bcdd67350f5a1885a9e08292eb6c5a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\EVSABA~1.TMP
MD5
c92a53cc671aa0e174d0697f7b6e35e9

SHA1
a2dd513e7988b2e2d56b4bede0840093ad2ac4bb

SHA256
aaf22f0fb83992b924ada07e7f7353c8cda6a208330aefc1e5127fcccc9e2aea

SHA512
e158f8318b2715a8176d15b5778632c99fbea5217f5921ce9da2737e3f63049c75a1982577c65f938b4dd62b853adbee80d0af0251dceae3f395a6ec87602e8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
MD5
14e173fe07917fef4e641eb80a2fa213

SHA1
3bdd028b2fccd6c774c21ddb9a3afc916b1d06df

SHA256
da4e48e3137b9bd0bfd3a9da5e205f93125bec8f4852336c07e3813fe0875679

SHA512
0102f8a53d564bcfa5ee328e9e5ee9f440919adae986e7b15674960c3af435cad1eefc684392cf918e9b6870995cf44f7860c49f219d4617922a1dcabcb9483c

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
MD5
14e173fe07917fef4e641eb80a2fa213

SHA1
3bdd028b2fccd6c774c21ddb9a3afc916b1d06df

SHA256
da4e48e3137b9bd0bfd3a9da5e205f93125bec8f4852336c07e3813fe0875679

SHA512
0102f8a53d564bcfa5ee328e9e5ee9f440919adae986e7b15674960c3af435cad1eefc684392cf918e9b6870995cf44f7860c49f219d4617922a1dcabcb9483c

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
MD5
4db8c2308b5ab9c8b43d8111272d1d1a

SHA1
8a556d2c045865033e230e16c69e406341ce602f

SHA256
89dc7453ef96644bae0d1c9419681d0587ec68ab08cd6fbb27599b798cc608c5

SHA512
36367a26e5b02c9977a5a63cd9ae102a612e426253ef18ca8acf4e48369b8a61a0c9b6631a8f5fef1f1a09dec8204d95fff06b5dbd94b9d04b7892c8c6c8d423

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
MD5
4db8c2308b5ab9c8b43d8111272d1d1a

SHA1
8a556d2c045865033e230e16c69e406341ce602f

SHA256
89dc7453ef96644bae0d1c9419681d0587ec68ab08cd6fbb27599b798cc608c5

SHA512
36367a26e5b02c9977a5a63cd9ae102a612e426253ef18ca8acf4e48369b8a61a0c9b6631a8f5fef1f1a09dec8204d95fff06b5dbd94b9d04b7892c8c6c8d423

Download Submit
C:\Users\Admin\AppData\Local\Temp\evsabapfenod.exe
MD5
ff776b2fb6736075adfcb1739a180491

SHA1
1c5cb0eb48f441d8493f7c5f6428d7af8c1c9abb

SHA256
ef6fc7bf417d763f9c7c8c9bf723ce7d3b4acbeb4cc47e65bcb3d6b8f143fee2

SHA512
58fe0bb6f3dcda9831332d0dfcd0d5a92d58ed1107a3d246c4b092be384535be0d1d33ca9728b6944be171e3fa62663608e27ca7834a725b6ca9f81fcba853c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\evsabapfenod.exe
MD5
ff776b2fb6736075adfcb1739a180491

SHA1
1c5cb0eb48f441d8493f7c5f6428d7af8c1c9abb

SHA256
ef6fc7bf417d763f9c7c8c9bf723ce7d3b4acbeb4cc47e65bcb3d6b8f143fee2

SHA512
58fe0bb6f3dcda9831332d0dfcd0d5a92d58ed1107a3d246c4b092be384535be0d1d33ca9728b6944be171e3fa62663608e27ca7834a725b6ca9f81fcba853c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\lhypardfjahw.vbs
MD5
bdff2af40e7fa049f2fb14fddbfed944

SHA1
45747e63646357d7742b8ba8682939dfc0832c85

SHA256
ccf8a60277e9a00f8e604ba4387774d5b0968ac32ec44576932bf7bd7841bfbf

SHA512
c1eae69c9104c04bec99793d963fbfac1966e38cc6ff734605557cdd7e71824ffd241b6d6544d7f1ba1ec8e394252e223efbae8fa94cb291990358f3cdab5ee1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp704F.tmp.ps1
MD5
c2105c0c771556efd3085f1892f55107

SHA1
950bafb95de7b401499ed053e8eaec209abd2923

SHA256
402e5eb9da1c2f3865292af8809c404766662afef51512100bee541fb2ed1397

SHA512
2a2ef3a6b3e612d27b25e254bd03f110572094c23189ae627e11c27e34c997b4b77b54c8791c2eeff58b0cf1bf5d783e297db139149983a8c6abc112409f3aff

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7050.tmp
MD5
c416c12d1b2b1da8c8655e393b544362

SHA1
fb1a43cd8e1c556c2d25f361f42a21293c29e447

SHA256
0600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046

SHA512
cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8168.tmp.ps1
MD5
c4458705d620474de3709b9f6a7aac91

SHA1
2ded319c1bc1b9f25da7ef36261143110d93031c

SHA256
04d1f50972fc6605083bbf779269e3ed6ff6716fdd384c4f3854d1da538dd2d8

SHA512
b2904e492c874dacd6151f70eb002c7f33291eb272d187fbfe39ce52346a4595c544f75e3bd6e4a253f1fad848fcd49a4775c1235da9dfbca4c427ef1775cb29

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8169.tmp
MD5
1860260b2697808b80802352fe324782

SHA1
f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b

SHA256
0c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1

SHA512
d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f

Download Submit
C:\Users\Admin\AppData\Local\Temp\xyrjgrdgdwd.vbs
MD5
e37037a939157cf5a2b68f2f90d574c5

SHA1
1e0ab2dc4cb51effbe740bf555d6c9674b570f39

SHA256
0dcc25b02c5df656e029c8724245dbb0b565b337322830b5232c1a1390a707ae

SHA512
4f84061b27ab9793d24c82bf28d49a25ca01338b7cd47c532319b310f3d34440bbf242ddb877fe2a40ad842252ce64826ba15d189f441aea055073d7c2a94907

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
MD5
14e173fe07917fef4e641eb80a2fa213

SHA1
3bdd028b2fccd6c774c21ddb9a3afc916b1d06df

SHA256
da4e48e3137b9bd0bfd3a9da5e205f93125bec8f4852336c07e3813fe0875679

SHA512
0102f8a53d564bcfa5ee328e9e5ee9f440919adae986e7b15674960c3af435cad1eefc684392cf918e9b6870995cf44f7860c49f219d4617922a1dcabcb9483c

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
MD5
14e173fe07917fef4e641eb80a2fa213

SHA1
3bdd028b2fccd6c774c21ddb9a3afc916b1d06df

SHA256
da4e48e3137b9bd0bfd3a9da5e205f93125bec8f4852336c07e3813fe0875679

SHA512
0102f8a53d564bcfa5ee328e9e5ee9f440919adae986e7b15674960c3af435cad1eefc684392cf918e9b6870995cf44f7860c49f219d4617922a1dcabcb9483c

Download Submit
\Users\Admin\AppData\Local\Temp\EVSABA~1.TMP
MD5
c92a53cc671aa0e174d0697f7b6e35e9

SHA1
a2dd513e7988b2e2d56b4bede0840093ad2ac4bb

SHA256
aaf22f0fb83992b924ada07e7f7353c8cda6a208330aefc1e5127fcccc9e2aea

SHA512
e158f8318b2715a8176d15b5778632c99fbea5217f5921ce9da2737e3f63049c75a1982577c65f938b4dd62b853adbee80d0af0251dceae3f395a6ec87602e8d

Download Submit
\Users\Admin\AppData\Local\Temp\EVSABA~1.TMP
MD5
c92a53cc671aa0e174d0697f7b6e35e9

SHA1
a2dd513e7988b2e2d56b4bede0840093ad2ac4bb

SHA256
aaf22f0fb83992b924ada07e7f7353c8cda6a208330aefc1e5127fcccc9e2aea

SHA512
e158f8318b2715a8176d15b5778632c99fbea5217f5921ce9da2737e3f63049c75a1982577c65f938b4dd62b853adbee80d0af0251dceae3f395a6ec87602e8d

Download Submit
\Users\Admin\AppData\Local\Temp\nsn2736.tmp\UAC.dll
MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
memory/60-132-0x00000000008B0000-0x00000000009FA000-memory.dmp

Filesize
1.3MB

Download
memory/60-133-0x0000000000400000-0x00000000008A3000-memory.dmp

Filesize
4.6MB

Download
memory/60-121-0x0000000000000000-mapping.dmp

Download
memory/348-213-0x0000000000000000-mapping.dmp

Download
memory/1104-131-0x0000000000000000-mapping.dmp

Download
memory/2172-197-0x0000000008630000-0x0000000008631000-memory.dmp

Filesize
4KB

Download
memory/2172-198-0x0000000007330000-0x0000000007331000-memory.dmp

Filesize
4KB

Download
memory/2172-199-0x0000000007332000-0x0000000007333000-memory.dmp

Filesize
4KB

Download
memory/2172-185-0x0000000000000000-mapping.dmp

Download
memory/2172-212-0x0000000007333000-0x0000000007334000-memory.dmp

Filesize
4KB

Download
memory/2172-194-0x00000000082E0000-0x00000000082E1000-memory.dmp

Filesize
4KB

Download
memory/2656-135-0x0000000000000000-mapping.dmp

Download
memory/2656-151-0x0000000005090000-0x0000000006326000-memory.dmp

Filesize
18.6MB

Download
memory/2668-124-0x00000000024B0000-0x00000000024D6000-memory.dmp

Filesize
152KB

Download
memory/2668-125-0x0000000000400000-0x00000000008A3000-memory.dmp

Filesize
4.6MB

Download
memory/2668-115-0x0000000000000000-mapping.dmp

Download
memory/2744-126-0x0000000002390000-0x00000000023B4000-memory.dmp

Filesize
144KB

Download
memory/2744-127-0x0000000000400000-0x00000000008A4000-memory.dmp

Filesize
4.6MB

Download
memory/2744-118-0x0000000000000000-mapping.dmp

Download
memory/2840-158-0x0000000005290000-0x0000000006526000-memory.dmp

Filesize
18.6MB

Download
memory/2840-148-0x0000000000000000-mapping.dmp

Download
memory/3308-128-0x0000000000000000-mapping.dmp

Download
memory/3308-139-0x0000000000400000-0x000000000097F000-memory.dmp

Filesize
5.5MB

Download
memory/3308-138-0x0000000002890000-0x0000000002990000-memory.dmp

Filesize
1024KB

Download
memory/3420-140-0x0000000000000000-mapping.dmp

Download
memory/3808-179-0x000000000A240000-0x000000000A241000-memory.dmp

Filesize
4KB

Download
memory/3808-163-0x0000000007A20000-0x0000000007A21000-memory.dmp

Filesize
4KB

Download
memory/3808-180-0x00000000097C0000-0x00000000097C1000-memory.dmp

Filesize
4KB

Download
memory/3808-181-0x00000000075E0000-0x00000000075E1000-memory.dmp

Filesize
4KB

Download
memory/3808-167-0x00000000083B0000-0x00000000083B1000-memory.dmp

Filesize
4KB

Download
memory/3808-184-0x00000000073E3000-0x00000000073E4000-memory.dmp

Filesize
4KB

Download
memory/3808-166-0x0000000008130000-0x0000000008131000-memory.dmp

Filesize
4KB

Download
memory/3808-165-0x00000000080C0000-0x00000000080C1000-memory.dmp

Filesize
4KB

Download
memory/3808-164-0x00000000079C0000-0x00000000079C1000-memory.dmp

Filesize
4KB

Download
memory/3808-169-0x00000000073E2000-0x00000000073E3000-memory.dmp

Filesize
4KB

Download
memory/3808-162-0x0000000007300000-0x0000000007301000-memory.dmp

Filesize
4KB

Download
memory/3808-159-0x0000000000000000-mapping.dmp

Download
memory/3808-174-0x0000000008B70000-0x0000000008B71000-memory.dmp

Filesize
4KB

Download
memory/3808-168-0x00000000073E0000-0x00000000073E1000-memory.dmp

Filesize
4KB

Download
memory/3808-170-0x00000000081E0000-0x00000000081E1000-memory.dmp

Filesize
4KB

Download
memory/3808-172-0x0000000008A40000-0x0000000008A41000-memory.dmp

Filesize
4KB

Download
memory/3808-171-0x0000000008CE0000-0x0000000008CE1000-memory.dmp

Filesize
4KB

Download
memory/3828-208-0x0000000000000000-mapping.dmp

Download
memory/3896-211-0x0000000000000000-mapping.dmp

Download