Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-06-2022 17:43
Static task
static1
Behavioral task
behavioral1
Sample
001'_202003_001'.js
Resource
win7-20220414-en
General
-
Target
001'_202003_001'.js
-
Size
1.0MB
-
MD5
d115552252592f589e7412d6650a949e
-
SHA1
ad4c6cd7e85541866f5cd0fa747b7f08a5fe8067
-
SHA256
3b55010b7f8f4e7ded435b29af5d00f98c06dd8f14258355d0049f186f4a6bbc
-
SHA512
461aebb7a488102e3de0c9b807dbf8d04a41737d050dc4ca95bbf8283ee5176845adafee6bf81db83a73af2b67e66f45adaad6a145062ae035208cee71adfa71
Malware Config
Extracted
danabot
164.175.70.152
89.144.25.243
86.177.194.155
29.195.96.191
29.43.1.29
84.215.94.117
115.58.63.174
89.144.25.104
199.179.34.46
68.48.87.153
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dll family_danabot \Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dll family_danabot \Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dll family_danabot \Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dll family_danabot \Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dll family_danabot \Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dll family_danabot -
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 1 1064 rundll32.exe 2 1064 rundll32.exe 4 1064 rundll32.exe 5 1064 rundll32.exe 6 1064 rundll32.exe 7 1064 rundll32.exe 8 1064 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 1416 regsvr32.exe 1064 rundll32.exe 1064 rundll32.exe 1064 rundll32.exe 1064 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
wscript.exeregsvr32.exeregsvr32.exedescription pid process target process PID 1660 wrote to memory of 840 1660 wscript.exe regsvr32.exe PID 1660 wrote to memory of 840 1660 wscript.exe regsvr32.exe PID 1660 wrote to memory of 840 1660 wscript.exe regsvr32.exe PID 1660 wrote to memory of 840 1660 wscript.exe regsvr32.exe PID 1660 wrote to memory of 840 1660 wscript.exe regsvr32.exe PID 840 wrote to memory of 1416 840 regsvr32.exe regsvr32.exe PID 840 wrote to memory of 1416 840 regsvr32.exe regsvr32.exe PID 840 wrote to memory of 1416 840 regsvr32.exe regsvr32.exe PID 840 wrote to memory of 1416 840 regsvr32.exe regsvr32.exe PID 840 wrote to memory of 1416 840 regsvr32.exe regsvr32.exe PID 840 wrote to memory of 1416 840 regsvr32.exe regsvr32.exe PID 840 wrote to memory of 1416 840 regsvr32.exe regsvr32.exe PID 1416 wrote to memory of 1064 1416 regsvr32.exe rundll32.exe PID 1416 wrote to memory of 1064 1416 regsvr32.exe rundll32.exe PID 1416 wrote to memory of 1064 1416 regsvr32.exe rundll32.exe PID 1416 wrote to memory of 1064 1416 regsvr32.exe rundll32.exe PID 1416 wrote to memory of 1064 1416 regsvr32.exe rundll32.exe PID 1416 wrote to memory of 1064 1416 regsvr32.exe rundll32.exe PID 1416 wrote to memory of 1064 1416 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\001'_202003_001'.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\\ALNYajCWUsjV.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\\ALNYajCWUsjV.dll3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dll,f04⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dllFilesize
284KB
MD582e719eae0182374cb433118d8d802d2
SHA1626ba0208fcf1ef29bf8cfa0e6f70ded70aee885
SHA2568e0dcdd85ab03fd0230f512158aaee86a29b6816c959bfd4ae6a91500f37e45c
SHA512914370240040c3ee6bc328a8c93b8a00ab20af44ac98222626ecee907bfe18a1e856f6b4a07c75073a40abd4b2caac042b9f92b7f3f774700cbfb5998ba8e968
-
\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dllFilesize
284KB
MD582e719eae0182374cb433118d8d802d2
SHA1626ba0208fcf1ef29bf8cfa0e6f70ded70aee885
SHA2568e0dcdd85ab03fd0230f512158aaee86a29b6816c959bfd4ae6a91500f37e45c
SHA512914370240040c3ee6bc328a8c93b8a00ab20af44ac98222626ecee907bfe18a1e856f6b4a07c75073a40abd4b2caac042b9f92b7f3f774700cbfb5998ba8e968
-
\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dllFilesize
284KB
MD582e719eae0182374cb433118d8d802d2
SHA1626ba0208fcf1ef29bf8cfa0e6f70ded70aee885
SHA2568e0dcdd85ab03fd0230f512158aaee86a29b6816c959bfd4ae6a91500f37e45c
SHA512914370240040c3ee6bc328a8c93b8a00ab20af44ac98222626ecee907bfe18a1e856f6b4a07c75073a40abd4b2caac042b9f92b7f3f774700cbfb5998ba8e968
-
\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dllFilesize
284KB
MD582e719eae0182374cb433118d8d802d2
SHA1626ba0208fcf1ef29bf8cfa0e6f70ded70aee885
SHA2568e0dcdd85ab03fd0230f512158aaee86a29b6816c959bfd4ae6a91500f37e45c
SHA512914370240040c3ee6bc328a8c93b8a00ab20af44ac98222626ecee907bfe18a1e856f6b4a07c75073a40abd4b2caac042b9f92b7f3f774700cbfb5998ba8e968
-
\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dllFilesize
284KB
MD582e719eae0182374cb433118d8d802d2
SHA1626ba0208fcf1ef29bf8cfa0e6f70ded70aee885
SHA2568e0dcdd85ab03fd0230f512158aaee86a29b6816c959bfd4ae6a91500f37e45c
SHA512914370240040c3ee6bc328a8c93b8a00ab20af44ac98222626ecee907bfe18a1e856f6b4a07c75073a40abd4b2caac042b9f92b7f3f774700cbfb5998ba8e968
-
\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dllFilesize
284KB
MD582e719eae0182374cb433118d8d802d2
SHA1626ba0208fcf1ef29bf8cfa0e6f70ded70aee885
SHA2568e0dcdd85ab03fd0230f512158aaee86a29b6816c959bfd4ae6a91500f37e45c
SHA512914370240040c3ee6bc328a8c93b8a00ab20af44ac98222626ecee907bfe18a1e856f6b4a07c75073a40abd4b2caac042b9f92b7f3f774700cbfb5998ba8e968
-
memory/840-55-0x000007FEFC331000-0x000007FEFC333000-memory.dmpFilesize
8KB
-
memory/840-54-0x0000000000000000-mapping.dmp
-
memory/1064-61-0x0000000000000000-mapping.dmp
-
memory/1064-67-0x00000000001C0000-0x0000000000215000-memory.dmpFilesize
340KB
-
memory/1416-57-0x0000000000000000-mapping.dmp
-
memory/1416-60-0x0000000000210000-0x0000000000265000-memory.dmpFilesize
340KB
-
memory/1416-58-0x0000000076781000-0x0000000076783000-memory.dmpFilesize
8KB