Analysis
-
max time kernel
137s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
31-12-2021 22:41
Static task
static1
General
-
Target
3e8044305c52c8ed72dff87aaa76b6ecb6264f00e7d1030af9f4b6954aa719d0.exe
-
Size
1.8MB
-
MD5
a4972219946625bfc86a9d0d93cfcdc4
-
SHA1
4eac439c6a4f756fe90e8adbd078c2527385e22e
-
SHA256
3e8044305c52c8ed72dff87aaa76b6ecb6264f00e7d1030af9f4b6954aa719d0
-
SHA512
ecd937e403e789b9f7fa40adcaebfa8ebaed00e1c1a86d2785e05c6515f96794843adda6e3995ae7a6329b2de19de59d24ec95971c3a789e51810bd329fb3e05
Malware Config
Extracted
danabot
4
142.11.244.223:443
192.236.194.72:443
-
embedded_hash
0FA95F120D6EB149A5D48E36BC76879D
-
type
loader
Signatures
-
Danabot Loader Component 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3E8044~1.DLL DanabotLoader2021 \Users\Admin\AppData\Local\Temp\3E8044~1.DLL DanabotLoader2021 -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 3360 created 3808 3360 WerFault.exe 3e8044305c52c8ed72dff87aaa76b6ecb6264f00e7d1030af9f4b6954aa719d0.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1140 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3360 3808 WerFault.exe 3e8044305c52c8ed72dff87aaa76b6ecb6264f00e7d1030af9f4b6954aa719d0.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 3360 WerFault.exe 3360 WerFault.exe 3360 WerFault.exe 3360 WerFault.exe 3360 WerFault.exe 3360 WerFault.exe 3360 WerFault.exe 3360 WerFault.exe 3360 WerFault.exe 3360 WerFault.exe 3360 WerFault.exe 3360 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3360 WerFault.exe Token: SeBackupPrivilege 3360 WerFault.exe Token: SeDebugPrivilege 3360 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
3e8044305c52c8ed72dff87aaa76b6ecb6264f00e7d1030af9f4b6954aa719d0.exedescription pid process target process PID 3808 wrote to memory of 1140 3808 3e8044305c52c8ed72dff87aaa76b6ecb6264f00e7d1030af9f4b6954aa719d0.exe rundll32.exe PID 3808 wrote to memory of 1140 3808 3e8044305c52c8ed72dff87aaa76b6ecb6264f00e7d1030af9f4b6954aa719d0.exe rundll32.exe PID 3808 wrote to memory of 1140 3808 3e8044305c52c8ed72dff87aaa76b6ecb6264f00e7d1030af9f4b6954aa719d0.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e8044305c52c8ed72dff87aaa76b6ecb6264f00e7d1030af9f4b6954aa719d0.exe"C:\Users\Admin\AppData\Local\Temp\3e8044305c52c8ed72dff87aaa76b6ecb6264f00e7d1030af9f4b6954aa719d0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3E8044~1.DLL,s C:\Users\Admin\AppData\Local\Temp\3E8044~1.EXE2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 5562⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3E8044~1.DLLMD5
488a68e535f66bb5af7fc4edb5c3064a
SHA1bbd7dba124257107ec2a0e2fe4fe7ded72491342
SHA25695e7c3b535bf7c47da10da4a1b0d6b4f6ea7f12ea927bfb47d94dd5bce24c06b
SHA512276fbb1eafa569ec11a80bc6cb21e2d654fee6279184ddc7400c3a88b10127a55b3bdd57b19de4d7435c01f944bedb12949ca6486819aa5004185a6dd324f588
-
\Users\Admin\AppData\Local\Temp\3E8044~1.DLLMD5
488a68e535f66bb5af7fc4edb5c3064a
SHA1bbd7dba124257107ec2a0e2fe4fe7ded72491342
SHA25695e7c3b535bf7c47da10da4a1b0d6b4f6ea7f12ea927bfb47d94dd5bce24c06b
SHA512276fbb1eafa569ec11a80bc6cb21e2d654fee6279184ddc7400c3a88b10127a55b3bdd57b19de4d7435c01f944bedb12949ca6486819aa5004185a6dd324f588
-
memory/1140-118-0x0000000000000000-mapping.dmp
-
memory/3808-115-0x0000000000DEF000-0x0000000000F7E000-memory.dmpFilesize
1.6MB
-
memory/3808-117-0x0000000000400000-0x0000000000902000-memory.dmpFilesize
5.0MB
-
memory/3808-116-0x0000000000F80000-0x0000000001125000-memory.dmpFilesize
1.6MB