Analysis
-
max time kernel
4294207s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
19-03-2022 06:47
Static task
static1
Behavioral task
behavioral1
Sample
6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b.exe
Resource
win7-20220310-en
General
-
Target
6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b.exe
-
Size
4.4MB
-
MD5
bbbf9b08ee68f03a9b314a0bb24493bb
-
SHA1
b63a49aa78bd940599ef14ad71fa56cb96ae0aff
-
SHA256
6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b
-
SHA512
69449cb2add2fea73be89ead33182580b05f97b94f3ae77867ac44e3a017e360ea317f49c5105e7f8f60d913bc8ec63dd555bd8aab63f0ff2c9ef3ecc9176afd
Malware Config
Extracted
danabot
1732
3
23.106.123.249:443
64.188.20.187:443
108.62.118.103:443
104.227.34.227:443
-
embedded_hash
7851EC18309CA04099F7F0BE42FF6C04
-
type
main
Signatures
-
suricata: ET MALWARE Danabot Key Exchange Request
suricata: ET MALWARE Danabot Key Exchange Request
-
Blocklisted process makes network request 4 IoCs
Processes:
RUNDLL32.EXEflow pid process 2 1824 RUNDLL32.EXE 3 1824 RUNDLL32.EXE 4 1824 RUNDLL32.EXE 5 1824 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 1064 rundll32.exe -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 1064 rundll32.exe 1064 rundll32.exe 1064 rundll32.exe 1064 rundll32.exe 1824 RUNDLL32.EXE 1824 RUNDLL32.EXE 1824 RUNDLL32.EXE 1824 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 6 IoCs
Processes:
RUNDLL32.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\QVSMV6J0\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini RUNDLL32.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exeRUNDLL32.EXEdescription pid process Token: SeDebugPrivilege 1064 rundll32.exe Token: SeDebugPrivilege 1824 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b.exerundll32.exedescription pid process target process PID 1604 wrote to memory of 1064 1604 6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b.exe rundll32.exe PID 1604 wrote to memory of 1064 1604 6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b.exe rundll32.exe PID 1604 wrote to memory of 1064 1604 6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b.exe rundll32.exe PID 1604 wrote to memory of 1064 1604 6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b.exe rundll32.exe PID 1604 wrote to memory of 1064 1604 6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b.exe rundll32.exe PID 1604 wrote to memory of 1064 1604 6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b.exe rundll32.exe PID 1604 wrote to memory of 1064 1604 6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b.exe rundll32.exe PID 1064 wrote to memory of 1824 1064 rundll32.exe RUNDLL32.EXE PID 1064 wrote to memory of 1824 1064 rundll32.exe RUNDLL32.EXE PID 1064 wrote to memory of 1824 1064 rundll32.exe RUNDLL32.EXE PID 1064 wrote to memory of 1824 1064 rundll32.exe RUNDLL32.EXE PID 1064 wrote to memory of 1824 1064 rundll32.exe RUNDLL32.EXE PID 1064 wrote to memory of 1824 1064 rundll32.exe RUNDLL32.EXE PID 1064 wrote to memory of 1824 1064 rundll32.exe RUNDLL32.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b.exe"C:\Users\Admin\AppData\Local\Temp\6787ef5832c890f5d9117f4d8bc85601100e7f236ad5830a4a00e64cb3160d7b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6787EF~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\6787EF~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\6787EF~1.DLL,WgNXjBzvAhT33⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6787EF~1.DLLMD5
80c8fc3e4f8f3d60fc03b6cbef598e77
SHA17c3e8ebc0ed2cad7d0f46eb7d99d15ade70c72ee
SHA25629ed67715882fc2294d0aaea64c4cd79697522a95d7a554d1c6b73ccd7b76d9e
SHA51261e12040d1b6252893f6913b18e190f9818c210e50309857863a3213d55a07c4c1bd8cb1d3489c6805ae698ec4c289eff24b3970dba78d24a08db6fcf3711e61
-
\Users\Admin\AppData\Local\Temp\6787EF~1.DLLMD5
80c8fc3e4f8f3d60fc03b6cbef598e77
SHA17c3e8ebc0ed2cad7d0f46eb7d99d15ade70c72ee
SHA25629ed67715882fc2294d0aaea64c4cd79697522a95d7a554d1c6b73ccd7b76d9e
SHA51261e12040d1b6252893f6913b18e190f9818c210e50309857863a3213d55a07c4c1bd8cb1d3489c6805ae698ec4c289eff24b3970dba78d24a08db6fcf3711e61
-
\Users\Admin\AppData\Local\Temp\6787EF~1.DLLMD5
80c8fc3e4f8f3d60fc03b6cbef598e77
SHA17c3e8ebc0ed2cad7d0f46eb7d99d15ade70c72ee
SHA25629ed67715882fc2294d0aaea64c4cd79697522a95d7a554d1c6b73ccd7b76d9e
SHA51261e12040d1b6252893f6913b18e190f9818c210e50309857863a3213d55a07c4c1bd8cb1d3489c6805ae698ec4c289eff24b3970dba78d24a08db6fcf3711e61
-
\Users\Admin\AppData\Local\Temp\6787EF~1.DLLMD5
80c8fc3e4f8f3d60fc03b6cbef598e77
SHA17c3e8ebc0ed2cad7d0f46eb7d99d15ade70c72ee
SHA25629ed67715882fc2294d0aaea64c4cd79697522a95d7a554d1c6b73ccd7b76d9e
SHA51261e12040d1b6252893f6913b18e190f9818c210e50309857863a3213d55a07c4c1bd8cb1d3489c6805ae698ec4c289eff24b3970dba78d24a08db6fcf3711e61
-
\Users\Admin\AppData\Local\Temp\6787EF~1.DLLMD5
80c8fc3e4f8f3d60fc03b6cbef598e77
SHA17c3e8ebc0ed2cad7d0f46eb7d99d15ade70c72ee
SHA25629ed67715882fc2294d0aaea64c4cd79697522a95d7a554d1c6b73ccd7b76d9e
SHA51261e12040d1b6252893f6913b18e190f9818c210e50309857863a3213d55a07c4c1bd8cb1d3489c6805ae698ec4c289eff24b3970dba78d24a08db6fcf3711e61
-
\Users\Admin\AppData\Local\Temp\6787EF~1.DLLMD5
80c8fc3e4f8f3d60fc03b6cbef598e77
SHA17c3e8ebc0ed2cad7d0f46eb7d99d15ade70c72ee
SHA25629ed67715882fc2294d0aaea64c4cd79697522a95d7a554d1c6b73ccd7b76d9e
SHA51261e12040d1b6252893f6913b18e190f9818c210e50309857863a3213d55a07c4c1bd8cb1d3489c6805ae698ec4c289eff24b3970dba78d24a08db6fcf3711e61
-
\Users\Admin\AppData\Local\Temp\6787EF~1.DLLMD5
80c8fc3e4f8f3d60fc03b6cbef598e77
SHA17c3e8ebc0ed2cad7d0f46eb7d99d15ade70c72ee
SHA25629ed67715882fc2294d0aaea64c4cd79697522a95d7a554d1c6b73ccd7b76d9e
SHA51261e12040d1b6252893f6913b18e190f9818c210e50309857863a3213d55a07c4c1bd8cb1d3489c6805ae698ec4c289eff24b3970dba78d24a08db6fcf3711e61
-
\Users\Admin\AppData\Local\Temp\6787EF~1.DLLMD5
80c8fc3e4f8f3d60fc03b6cbef598e77
SHA17c3e8ebc0ed2cad7d0f46eb7d99d15ade70c72ee
SHA25629ed67715882fc2294d0aaea64c4cd79697522a95d7a554d1c6b73ccd7b76d9e
SHA51261e12040d1b6252893f6913b18e190f9818c210e50309857863a3213d55a07c4c1bd8cb1d3489c6805ae698ec4c289eff24b3970dba78d24a08db6fcf3711e61
-
\Users\Admin\AppData\Local\Temp\6787EF~1.DLLMD5
80c8fc3e4f8f3d60fc03b6cbef598e77
SHA17c3e8ebc0ed2cad7d0f46eb7d99d15ade70c72ee
SHA25629ed67715882fc2294d0aaea64c4cd79697522a95d7a554d1c6b73ccd7b76d9e
SHA51261e12040d1b6252893f6913b18e190f9818c210e50309857863a3213d55a07c4c1bd8cb1d3489c6805ae698ec4c289eff24b3970dba78d24a08db6fcf3711e61
-
memory/1064-68-0x0000000002CF0000-0x0000000002CF1000-memory.dmpFilesize
4KB
-
memory/1064-65-0x0000000001DE0000-0x00000000021AB000-memory.dmpFilesize
3.8MB
-
memory/1064-66-0x00000000025C0000-0x0000000002C1F000-memory.dmpFilesize
6.4MB
-
memory/1064-67-0x00000000025C0000-0x0000000002C1F000-memory.dmpFilesize
6.4MB
-
memory/1604-58-0x0000000000400000-0x000000000552B000-memory.dmpFilesize
81.2MB
-
memory/1604-55-0x0000000005700000-0x0000000005ACB000-memory.dmpFilesize
3.8MB
-
memory/1604-54-0x0000000005700000-0x0000000005ACB000-memory.dmpFilesize
3.8MB
-
memory/1604-56-0x0000000005AD0000-0x0000000005EAD000-memory.dmpFilesize
3.9MB
-
memory/1604-57-0x0000000076361000-0x0000000076363000-memory.dmpFilesize
8KB
-
memory/1824-74-0x0000000001D80000-0x000000000214B000-memory.dmpFilesize
3.8MB
-
memory/1824-75-0x0000000002560000-0x0000000002BBF000-memory.dmpFilesize
6.4MB
-
memory/1824-77-0x0000000002560000-0x0000000002BBF000-memory.dmpFilesize
6.4MB
-
memory/1824-76-0x0000000002D10000-0x0000000002D11000-memory.dmpFilesize
4KB