Analysis
-
max time kernel
147s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
06-01-2022 00:00
Static task
static1
General
-
Target
bb73e798af4ed96af01717646d0ca442a35d3945304cae6d2aae357783dc3a9e.exe
-
Size
1.8MB
-
MD5
c092859a2a92b7681c0d61f61567b5e5
-
SHA1
b3d065b9a5d8bedcef7f9af9e901f88312a32e52
-
SHA256
bb73e798af4ed96af01717646d0ca442a35d3945304cae6d2aae357783dc3a9e
-
SHA512
76d94b91e698f60a36db7e58f4754995e52cbde3852bac33e62beb9a9f8453fa21d4ae22ec0e055deecca1444dc476634cf000cb784216746b9692299246b87e
Malware Config
Extracted
danabot
4
142.11.244.223:443
192.236.194.72:443
-
embedded_hash
0FA95F120D6EB149A5D48E36BC76879D
-
type
loader
Signatures
-
Danabot Loader Component 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\BB73E7~1.DLL DanabotLoader2021 \Users\Admin\AppData\Local\Temp\BB73E7~1.DLL DanabotLoader2021 -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 956 created 2708 956 WerFault.exe bb73e798af4ed96af01717646d0ca442a35d3945304cae6d2aae357783dc3a9e.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3564 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 956 2708 WerFault.exe bb73e798af4ed96af01717646d0ca442a35d3945304cae6d2aae357783dc3a9e.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 956 WerFault.exe 956 WerFault.exe 956 WerFault.exe 956 WerFault.exe 956 WerFault.exe 956 WerFault.exe 956 WerFault.exe 956 WerFault.exe 956 WerFault.exe 956 WerFault.exe 956 WerFault.exe 956 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 956 WerFault.exe Token: SeBackupPrivilege 956 WerFault.exe Token: SeDebugPrivilege 956 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
bb73e798af4ed96af01717646d0ca442a35d3945304cae6d2aae357783dc3a9e.exedescription pid process target process PID 2708 wrote to memory of 3564 2708 bb73e798af4ed96af01717646d0ca442a35d3945304cae6d2aae357783dc3a9e.exe rundll32.exe PID 2708 wrote to memory of 3564 2708 bb73e798af4ed96af01717646d0ca442a35d3945304cae6d2aae357783dc3a9e.exe rundll32.exe PID 2708 wrote to memory of 3564 2708 bb73e798af4ed96af01717646d0ca442a35d3945304cae6d2aae357783dc3a9e.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb73e798af4ed96af01717646d0ca442a35d3945304cae6d2aae357783dc3a9e.exe"C:\Users\Admin\AppData\Local\Temp\bb73e798af4ed96af01717646d0ca442a35d3945304cae6d2aae357783dc3a9e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\BB73E7~1.DLL,s C:\Users\Admin\AppData\Local\Temp\BB73E7~1.EXE2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 5762⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BB73E7~1.DLLMD5
efbfdd374b347900d0168b6c57e4a615
SHA1a035a31f434f31c30b9e61dd82a66a96ac024e12
SHA2564538b6929ef5fd27e117b61ff585b62c8277427a55cdf7caef7536706ab5aae3
SHA5123e9be842de3b278f32f4e7687f157c5cd311a7fdf006b7dd308d72d1c98687ca3229a7b1f4c3d1d52627c9379f8fb87ec52738e38a6bab87c6b0ae0a3e385c47
-
\Users\Admin\AppData\Local\Temp\BB73E7~1.DLLMD5
efbfdd374b347900d0168b6c57e4a615
SHA1a035a31f434f31c30b9e61dd82a66a96ac024e12
SHA2564538b6929ef5fd27e117b61ff585b62c8277427a55cdf7caef7536706ab5aae3
SHA5123e9be842de3b278f32f4e7687f157c5cd311a7fdf006b7dd308d72d1c98687ca3229a7b1f4c3d1d52627c9379f8fb87ec52738e38a6bab87c6b0ae0a3e385c47
-
memory/2708-115-0x0000000000A06000-0x0000000000B96000-memory.dmpFilesize
1.6MB
-
memory/2708-117-0x0000000000400000-0x00000000005E1000-memory.dmpFilesize
1.9MB
-
memory/2708-116-0x0000000000BA0000-0x0000000000D46000-memory.dmpFilesize
1.6MB
-
memory/3564-118-0x0000000000000000-mapping.dmp