Analysis
-
max time kernel
145s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 21:34
Static task
static1
Behavioral task
behavioral1
Sample
001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af.exe
Resource
win7-20220414-en
General
-
Target
001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af.exe
-
Size
4.9MB
-
MD5
b3ac1bb9077189033e3d426090d86155
-
SHA1
dae9827f34d94179aa956c12012b3472c8a74fb3
-
SHA256
001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af
-
SHA512
6cf5cc1ad10096e00405a5fc675300db67405f326839107c5656442e1173c5cdb13a0efaaf3a54b875695e1381b7402682d9421125e76cba82b5f65751572f12
Malware Config
Extracted
danabot
1732
3
23.226.132.92:443
23.106.123.249:443
108.62.141.152:443
104.144.64.163:443
-
embedded_hash
49574F66CD0103BBD725C08A9805C2BE
-
type
main
Signatures
-
suricata: ET MALWARE Danabot Key Exchange Request
suricata: ET MALWARE Danabot Key Exchange Request
-
Blocklisted process makes network request 4 IoCs
Processes:
RUNDLL32.EXEflow pid process 1 1548 RUNDLL32.EXE 3 1548 RUNDLL32.EXE 4 1548 RUNDLL32.EXE 7 1548 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 1012 rundll32.exe -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1548 RUNDLL32.EXE 1548 RUNDLL32.EXE 1548 RUNDLL32.EXE 1548 RUNDLL32.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exeRUNDLL32.EXEdescription pid process Token: SeDebugPrivilege 1012 rundll32.exe Token: SeDebugPrivilege 1548 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af.exerundll32.exedescription pid process target process PID 1728 wrote to memory of 1012 1728 001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af.exe rundll32.exe PID 1728 wrote to memory of 1012 1728 001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af.exe rundll32.exe PID 1728 wrote to memory of 1012 1728 001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af.exe rundll32.exe PID 1728 wrote to memory of 1012 1728 001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af.exe rundll32.exe PID 1728 wrote to memory of 1012 1728 001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af.exe rundll32.exe PID 1728 wrote to memory of 1012 1728 001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af.exe rundll32.exe PID 1728 wrote to memory of 1012 1728 001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af.exe rundll32.exe PID 1012 wrote to memory of 1548 1012 rundll32.exe RUNDLL32.EXE PID 1012 wrote to memory of 1548 1012 rundll32.exe RUNDLL32.EXE PID 1012 wrote to memory of 1548 1012 rundll32.exe RUNDLL32.EXE PID 1012 wrote to memory of 1548 1012 rundll32.exe RUNDLL32.EXE PID 1012 wrote to memory of 1548 1012 rundll32.exe RUNDLL32.EXE PID 1012 wrote to memory of 1548 1012 rundll32.exe RUNDLL32.EXE PID 1012 wrote to memory of 1548 1012 rundll32.exe RUNDLL32.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af.exe"C:\Users\Admin\AppData\Local\Temp\001b027326f1f5c85828de1a2d2795a6ad5648a75b4c837ffa453202e7c980af.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\001B02~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\001B02~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\001B02~1.DLL,jSxhjBz9Ag==3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\001B02~1.DLLFilesize
3.7MB
MD5f26f748189e89ba787e8a68284689617
SHA148ec327fadb4065f3d0e37f76201344971e1468f
SHA2569b1ae4317956215ba51e7d37a5f082626628f33f8ae868d969e9b56682c276ef
SHA51234758cba4e046d076a88bd7926bb2422ad2dcbd5e62d2d3c42089329e572644115b86c67cd09e58c95d8d297f44e6476c6e9974aff39c0060cb7b13eaa8f961b
-
\Users\Admin\AppData\Local\Temp\001B02~1.DLLFilesize
3.7MB
MD5f26f748189e89ba787e8a68284689617
SHA148ec327fadb4065f3d0e37f76201344971e1468f
SHA2569b1ae4317956215ba51e7d37a5f082626628f33f8ae868d969e9b56682c276ef
SHA51234758cba4e046d076a88bd7926bb2422ad2dcbd5e62d2d3c42089329e572644115b86c67cd09e58c95d8d297f44e6476c6e9974aff39c0060cb7b13eaa8f961b
-
\Users\Admin\AppData\Local\Temp\001B02~1.DLLFilesize
3.7MB
MD5f26f748189e89ba787e8a68284689617
SHA148ec327fadb4065f3d0e37f76201344971e1468f
SHA2569b1ae4317956215ba51e7d37a5f082626628f33f8ae868d969e9b56682c276ef
SHA51234758cba4e046d076a88bd7926bb2422ad2dcbd5e62d2d3c42089329e572644115b86c67cd09e58c95d8d297f44e6476c6e9974aff39c0060cb7b13eaa8f961b
-
\Users\Admin\AppData\Local\Temp\001B02~1.DLLFilesize
3.7MB
MD5f26f748189e89ba787e8a68284689617
SHA148ec327fadb4065f3d0e37f76201344971e1468f
SHA2569b1ae4317956215ba51e7d37a5f082626628f33f8ae868d969e9b56682c276ef
SHA51234758cba4e046d076a88bd7926bb2422ad2dcbd5e62d2d3c42089329e572644115b86c67cd09e58c95d8d297f44e6476c6e9974aff39c0060cb7b13eaa8f961b
-
\Users\Admin\AppData\Local\Temp\001B02~1.DLLFilesize
3.7MB
MD5f26f748189e89ba787e8a68284689617
SHA148ec327fadb4065f3d0e37f76201344971e1468f
SHA2569b1ae4317956215ba51e7d37a5f082626628f33f8ae868d969e9b56682c276ef
SHA51234758cba4e046d076a88bd7926bb2422ad2dcbd5e62d2d3c42089329e572644115b86c67cd09e58c95d8d297f44e6476c6e9974aff39c0060cb7b13eaa8f961b
-
\Users\Admin\AppData\Local\Temp\001B02~1.DLLFilesize
3.7MB
MD5f26f748189e89ba787e8a68284689617
SHA148ec327fadb4065f3d0e37f76201344971e1468f
SHA2569b1ae4317956215ba51e7d37a5f082626628f33f8ae868d969e9b56682c276ef
SHA51234758cba4e046d076a88bd7926bb2422ad2dcbd5e62d2d3c42089329e572644115b86c67cd09e58c95d8d297f44e6476c6e9974aff39c0060cb7b13eaa8f961b
-
\Users\Admin\AppData\Local\Temp\001B02~1.DLLFilesize
3.7MB
MD5f26f748189e89ba787e8a68284689617
SHA148ec327fadb4065f3d0e37f76201344971e1468f
SHA2569b1ae4317956215ba51e7d37a5f082626628f33f8ae868d969e9b56682c276ef
SHA51234758cba4e046d076a88bd7926bb2422ad2dcbd5e62d2d3c42089329e572644115b86c67cd09e58c95d8d297f44e6476c6e9974aff39c0060cb7b13eaa8f961b
-
\Users\Admin\AppData\Local\Temp\001B02~1.DLLFilesize
3.7MB
MD5f26f748189e89ba787e8a68284689617
SHA148ec327fadb4065f3d0e37f76201344971e1468f
SHA2569b1ae4317956215ba51e7d37a5f082626628f33f8ae868d969e9b56682c276ef
SHA51234758cba4e046d076a88bd7926bb2422ad2dcbd5e62d2d3c42089329e572644115b86c67cd09e58c95d8d297f44e6476c6e9974aff39c0060cb7b13eaa8f961b
-
\Users\Admin\AppData\Local\Temp\001B02~1.DLLFilesize
3.7MB
MD5f26f748189e89ba787e8a68284689617
SHA148ec327fadb4065f3d0e37f76201344971e1468f
SHA2569b1ae4317956215ba51e7d37a5f082626628f33f8ae868d969e9b56682c276ef
SHA51234758cba4e046d076a88bd7926bb2422ad2dcbd5e62d2d3c42089329e572644115b86c67cd09e58c95d8d297f44e6476c6e9974aff39c0060cb7b13eaa8f961b
-
memory/1012-58-0x0000000000000000-mapping.dmp
-
memory/1012-66-0x0000000001E70000-0x000000000223B000-memory.dmpFilesize
3.8MB
-
memory/1012-67-0x0000000002650000-0x0000000002CAF000-memory.dmpFilesize
6.4MB
-
memory/1012-76-0x0000000002650000-0x0000000002CAF000-memory.dmpFilesize
6.4MB
-
memory/1548-75-0x00000000025F0000-0x0000000002C4F000-memory.dmpFilesize
6.4MB
-
memory/1548-68-0x0000000000000000-mapping.dmp
-
memory/1548-74-0x0000000001F50000-0x000000000231B000-memory.dmpFilesize
3.8MB
-
memory/1548-77-0x00000000025F0000-0x0000000002C4F000-memory.dmpFilesize
6.4MB
-
memory/1728-54-0x0000000000400000-0x0000000004B69000-memory.dmpFilesize
71.4MB
-
memory/1728-55-0x0000000075381000-0x0000000075383000-memory.dmpFilesize
8KB
-
memory/1728-56-0x0000000004E20000-0x00000000051EB000-memory.dmpFilesize
3.8MB
-
memory/1728-57-0x00000000051F0000-0x00000000055CD000-memory.dmpFilesize
3.9MB
-
memory/1728-60-0x0000000000400000-0x0000000004B69000-memory.dmpFilesize
71.4MB