Analysis
-
max time kernel
148s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-04-2022 09:11
Static task
static1
Behavioral task
behavioral1
Sample
222_737_810193.vbs
Resource
win7-20220414-en
General
-
Target
222_737_810193.vbs
-
Size
1.3MB
-
MD5
9a6daf1dd79a5b780136e3c21acf6a8b
-
SHA1
8db287888a361391e501cf05f7958c09f75a90c4
-
SHA256
e730840f8a1ff98811c5a271bc482802db14c9a8f84641ac91b1ad4e0dba7a8f
-
SHA512
edf2e1b385541b9a26059f0ca5cb92c67533e75c96d653c67bdb48912aca7b0d65b83680ad94b1c380dc422a55274251c6384079a30dc34c5c7e51cb79a9ebae
Malware Config
Extracted
danabot
1.5.78.29
71.61.197.13
128.43.39.106
68.164.114.181
243.7.235.34
185.92.222.238
192.71.249.51
42.180.72.123
159.159.89.172
135.231.151.187
Signatures
-
Danabot x86 payload 3 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq family_danabot C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq family_danabot C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq family_danabot -
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 14 5080 rundll32.exe 15 5080 rundll32.exe 16 5080 rundll32.exe 19 5080 rundll32.exe 22 5080 rundll32.exe 29 5080 rundll32.exe 32 5080 rundll32.exe -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exerundll32.exepid process 2828 regsvr32.exe 5080 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
regsvr32.exerundll32.exepid process 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 2828 regsvr32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe 5080 rundll32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
WScript.exeregsvr32.exeregsvr32.exedescription pid process target process PID 1004 wrote to memory of 4356 1004 WScript.exe regsvr32.exe PID 1004 wrote to memory of 4356 1004 WScript.exe regsvr32.exe PID 4356 wrote to memory of 2828 4356 regsvr32.exe regsvr32.exe PID 4356 wrote to memory of 2828 4356 regsvr32.exe regsvr32.exe PID 4356 wrote to memory of 2828 4356 regsvr32.exe regsvr32.exe PID 2828 wrote to memory of 5080 2828 regsvr32.exe rundll32.exe PID 2828 wrote to memory of 5080 2828 regsvr32.exe rundll32.exe PID 2828 wrote to memory of 5080 2828 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\222_737_810193.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeregsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\\bxVLP.dlljYEdebHq2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\\bxVLP.dlljYEdebHq3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq,f04⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHqFilesize
459KB
MD578ad1f6983266579b20b1605dbdc63b4
SHA1e11f91abb0ad60cc5d781da51339cf196c499da7
SHA2569a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa
SHA5123509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097
-
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHqFilesize
459KB
MD578ad1f6983266579b20b1605dbdc63b4
SHA1e11f91abb0ad60cc5d781da51339cf196c499da7
SHA2569a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa
SHA5123509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097
-
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHqFilesize
459KB
MD578ad1f6983266579b20b1605dbdc63b4
SHA1e11f91abb0ad60cc5d781da51339cf196c499da7
SHA2569a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa
SHA5123509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097
-
memory/2828-132-0x0000000000000000-mapping.dmp
-
memory/2828-134-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/4356-130-0x0000000000000000-mapping.dmp
-
memory/5080-135-0x0000000000000000-mapping.dmp