Analysis
-
max time kernel
193s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-06-2022 17:43
Static task
static1
Behavioral task
behavioral1
Sample
001'_202003_001'.js
Resource
win7-20220414-en
General
-
Target
001'_202003_001'.js
-
Size
1.0MB
-
MD5
d115552252592f589e7412d6650a949e
-
SHA1
ad4c6cd7e85541866f5cd0fa747b7f08a5fe8067
-
SHA256
3b55010b7f8f4e7ded435b29af5d00f98c06dd8f14258355d0049f186f4a6bbc
-
SHA512
461aebb7a488102e3de0c9b807dbf8d04a41737d050dc4ca95bbf8283ee5176845adafee6bf81db83a73af2b67e66f45adaad6a145062ae035208cee71adfa71
Malware Config
Extracted
danabot
164.175.70.152
89.144.25.243
86.177.194.155
29.195.96.191
29.43.1.29
84.215.94.117
115.58.63.174
89.144.25.104
199.179.34.46
68.48.87.153
Signatures
-
Danabot x86 payload 3 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dll family_danabot C:\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dll family_danabot C:\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dll family_danabot -
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 20 2444 rundll32.exe 21 2444 rundll32.exe 28 2444 rundll32.exe 33 2444 rundll32.exe 38 2444 rundll32.exe 41 2444 rundll32.exe 48 2444 rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wscript.exe -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exerundll32.exepid process 4836 regsvr32.exe 2444 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
wscript.exeregsvr32.exeregsvr32.exedescription pid process target process PID 3688 wrote to memory of 2072 3688 wscript.exe regsvr32.exe PID 3688 wrote to memory of 2072 3688 wscript.exe regsvr32.exe PID 2072 wrote to memory of 4836 2072 regsvr32.exe regsvr32.exe PID 2072 wrote to memory of 4836 2072 regsvr32.exe regsvr32.exe PID 2072 wrote to memory of 4836 2072 regsvr32.exe regsvr32.exe PID 4836 wrote to memory of 2444 4836 regsvr32.exe rundll32.exe PID 4836 wrote to memory of 2444 4836 regsvr32.exe rundll32.exe PID 4836 wrote to memory of 2444 4836 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\001'_202003_001'.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\\ALNYajCWUsjV.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\\ALNYajCWUsjV.dll3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dll,f04⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dllFilesize
284KB
MD582e719eae0182374cb433118d8d802d2
SHA1626ba0208fcf1ef29bf8cfa0e6f70ded70aee885
SHA2568e0dcdd85ab03fd0230f512158aaee86a29b6816c959bfd4ae6a91500f37e45c
SHA512914370240040c3ee6bc328a8c93b8a00ab20af44ac98222626ecee907bfe18a1e856f6b4a07c75073a40abd4b2caac042b9f92b7f3f774700cbfb5998ba8e968
-
C:\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dllFilesize
284KB
MD582e719eae0182374cb433118d8d802d2
SHA1626ba0208fcf1ef29bf8cfa0e6f70ded70aee885
SHA2568e0dcdd85ab03fd0230f512158aaee86a29b6816c959bfd4ae6a91500f37e45c
SHA512914370240040c3ee6bc328a8c93b8a00ab20af44ac98222626ecee907bfe18a1e856f6b4a07c75073a40abd4b2caac042b9f92b7f3f774700cbfb5998ba8e968
-
C:\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dllFilesize
284KB
MD582e719eae0182374cb433118d8d802d2
SHA1626ba0208fcf1ef29bf8cfa0e6f70ded70aee885
SHA2568e0dcdd85ab03fd0230f512158aaee86a29b6816c959bfd4ae6a91500f37e45c
SHA512914370240040c3ee6bc328a8c93b8a00ab20af44ac98222626ecee907bfe18a1e856f6b4a07c75073a40abd4b2caac042b9f92b7f3f774700cbfb5998ba8e968
-
memory/2072-130-0x0000000000000000-mapping.dmp
-
memory/2444-134-0x0000000000000000-mapping.dmp
-
memory/4836-132-0x0000000000000000-mapping.dmp