Analysis
-
max time kernel
185s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02-05-2022 23:22
Static task
static1
Behavioral task
behavioral1
Sample
222_737_810158.vbs
Resource
win7-20220414-en
General
-
Target
222_737_810158.vbs
-
Size
1.4MB
-
MD5
c5405d72402de5c0d7303bbcf0f701b6
-
SHA1
f4bd158ef7e3f1d1fc66a2ebb0fe0f97d1328b25
-
SHA256
031696a851471374edc973ea9fa0085bdf491e9874533fc75e827d8bef00e2c9
-
SHA512
4fa90d32fda1201e162811c361ff2ebcccb521144fa7db844ec2bb0e3e379cd41e1a488bef62846d45b99f49aebb8ec2886e84c882c3d31e33e059936998ca71
Malware Config
Extracted
danabot
1.5.78.29
71.61.197.13
128.43.39.106
68.164.114.181
243.7.235.34
185.92.222.238
192.71.249.51
42.180.72.123
159.159.89.172
135.231.151.187
Signatures
-
Danabot x86 payload 5 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq family_danabot C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq family_danabot C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq family_danabot C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq family_danabot C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq family_danabot -
Blocklisted process makes network request 8 IoCs
Processes:
rundll32.exeflow pid process 45 2092 rundll32.exe 59 2092 rundll32.exe 78 2092 rundll32.exe 79 2092 rundll32.exe 80 2092 rundll32.exe 89 2092 rundll32.exe 103 2092 rundll32.exe 106 2092 rundll32.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exerundll32.exepid process 3908 regsvr32.exe 3908 regsvr32.exe 2092 rundll32.exe 2092 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
regsvr32.exerundll32.exepid process 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 3908 regsvr32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe 2092 rundll32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
WScript.exeregsvr32.exeregsvr32.exedescription pid process target process PID 1208 wrote to memory of 220 1208 WScript.exe regsvr32.exe PID 1208 wrote to memory of 220 1208 WScript.exe regsvr32.exe PID 220 wrote to memory of 3908 220 regsvr32.exe regsvr32.exe PID 220 wrote to memory of 3908 220 regsvr32.exe regsvr32.exe PID 220 wrote to memory of 3908 220 regsvr32.exe regsvr32.exe PID 3908 wrote to memory of 2092 3908 regsvr32.exe rundll32.exe PID 3908 wrote to memory of 2092 3908 regsvr32.exe rundll32.exe PID 3908 wrote to memory of 2092 3908 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\222_737_810158.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeregsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\\bxVLP.dlljYEdebHq2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\\bxVLP.dlljYEdebHq3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHq,f04⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHqFilesize
459KB
MD578ad1f6983266579b20b1605dbdc63b4
SHA1e11f91abb0ad60cc5d781da51339cf196c499da7
SHA2569a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa
SHA5123509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097
-
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHqFilesize
459KB
MD578ad1f6983266579b20b1605dbdc63b4
SHA1e11f91abb0ad60cc5d781da51339cf196c499da7
SHA2569a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa
SHA5123509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097
-
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHqFilesize
459KB
MD578ad1f6983266579b20b1605dbdc63b4
SHA1e11f91abb0ad60cc5d781da51339cf196c499da7
SHA2569a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa
SHA5123509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097
-
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHqFilesize
459KB
MD578ad1f6983266579b20b1605dbdc63b4
SHA1e11f91abb0ad60cc5d781da51339cf196c499da7
SHA2569a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa
SHA5123509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097
-
C:\Users\Admin\AppData\Local\Temp\bxVLP.dlljYEdebHqFilesize
459KB
MD578ad1f6983266579b20b1605dbdc63b4
SHA1e11f91abb0ad60cc5d781da51339cf196c499da7
SHA2569a99c355af51ff7b712487c8576afcb9dafd2e1b98e93036339243ec7edf05fa
SHA5123509f26f26c88b31459e241078f076d28b6f434e37196f315f0776739bfa14b9bf9258a354b90b265516aea65244acdcb8a8885a4c4450a242c65dade9af5097
-
memory/220-130-0x0000000000000000-mapping.dmp
-
memory/2092-136-0x0000000000000000-mapping.dmp
-
memory/2092-139-0x0000000000AC0000-0x0000000000B40000-memory.dmpFilesize
512KB
-
memory/3908-132-0x0000000000000000-mapping.dmp
-
memory/3908-135-0x0000000000850000-0x00000000008D0000-memory.dmpFilesize
512KB