Analysis
-
max time kernel
148s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 06:05
Static task
static1
Behavioral task
behavioral1
Sample
Receipt#2019#6dee13ba19fcef2b7b9c5f05086580cb1.vbs
Resource
win7-20220414-en
General
-
Target
Receipt#2019#6dee13ba19fcef2b7b9c5f05086580cb1.vbs
-
Size
4.9MB
-
MD5
f3ed87b32b193290549208db85679ca6
-
SHA1
ba83a0ec36bcf851b9a12bcaf545973f7499193c
-
SHA256
4747f8d0515a3209e45ffdb4fe25cf62f8b5db48faff4357362c45d56e25db83
-
SHA512
bcdcd1fa7b075d99ccb982ea81fef77fc6b51f10fd3e8f6be88f7abeb74f4f410d9752077233a71929520c4b9cd54c6ec770fb0e41ee178fd865252f446169e9
Malware Config
Extracted
danabot
214.117.153.178
254.72.43.217
150.116.120.176
199.21.37.100
46.168.211.8
175.16.177.89
17.31.87.118
95.179.168.37
117.111.1.23
207.148.83.108
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
yara_rule family_danabot C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt family_danabot C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt family_danabot C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt family_danabot C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt family_danabot C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt family_danabot -
Blocklisted process makes network request 6 IoCs
Processes:
rundll32.exeflow pid process 17 3396 rundll32.exe 27 3396 rundll32.exe 31 3396 rundll32.exe 38 3396 rundll32.exe 45 3396 rundll32.exe 46 3396 rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation WScript.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exerundll32.exepid process 8 regsvr32.exe 8 regsvr32.exe 3396 rundll32.exe 3396 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
WScript.exeregsvr32.exeregsvr32.exedescription pid process target process PID 3164 wrote to memory of 4452 3164 WScript.exe regsvr32.exe PID 3164 wrote to memory of 4452 3164 WScript.exe regsvr32.exe PID 4452 wrote to memory of 8 4452 regsvr32.exe regsvr32.exe PID 4452 wrote to memory of 8 4452 regsvr32.exe regsvr32.exe PID 4452 wrote to memory of 8 4452 regsvr32.exe regsvr32.exe PID 8 wrote to memory of 3396 8 regsvr32.exe rundll32.exe PID 8 wrote to memory of 3396 8 regsvr32.exe rundll32.exe PID 8 wrote to memory of 3396 8 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Receipt#2019#6dee13ba19fcef2b7b9c5f05086580cb1.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\IEeHCa.txt,f04⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IEeHCa.txtFilesize
1.4MB
MD521e8502d416221b2d998133680b8f2b6
SHA13efa1f38b2f151cc55cd632a325e888ed262dca6
SHA256caf2a70ee7b1300b0b88cbe2a594cc0a959f8b1b043c668fde9c20961d60d64f
SHA51259e88fc5d4c3ddc784daed2ed2e415c86ce4f922bba30b8131aed48a674233593dc23398c8cde8e82a88fa6cd70dd916905530107a547fb34f158b9bdb540efd
-
C:\Users\Admin\AppData\Local\Temp\IEeHCa.txtFilesize
1.4MB
MD521e8502d416221b2d998133680b8f2b6
SHA13efa1f38b2f151cc55cd632a325e888ed262dca6
SHA256caf2a70ee7b1300b0b88cbe2a594cc0a959f8b1b043c668fde9c20961d60d64f
SHA51259e88fc5d4c3ddc784daed2ed2e415c86ce4f922bba30b8131aed48a674233593dc23398c8cde8e82a88fa6cd70dd916905530107a547fb34f158b9bdb540efd
-
C:\Users\Admin\AppData\Local\Temp\IEeHCa.txtFilesize
1.4MB
MD521e8502d416221b2d998133680b8f2b6
SHA13efa1f38b2f151cc55cd632a325e888ed262dca6
SHA256caf2a70ee7b1300b0b88cbe2a594cc0a959f8b1b043c668fde9c20961d60d64f
SHA51259e88fc5d4c3ddc784daed2ed2e415c86ce4f922bba30b8131aed48a674233593dc23398c8cde8e82a88fa6cd70dd916905530107a547fb34f158b9bdb540efd
-
C:\Users\Admin\AppData\Local\Temp\IEeHCa.txtFilesize
1.4MB
MD521e8502d416221b2d998133680b8f2b6
SHA13efa1f38b2f151cc55cd632a325e888ed262dca6
SHA256caf2a70ee7b1300b0b88cbe2a594cc0a959f8b1b043c668fde9c20961d60d64f
SHA51259e88fc5d4c3ddc784daed2ed2e415c86ce4f922bba30b8131aed48a674233593dc23398c8cde8e82a88fa6cd70dd916905530107a547fb34f158b9bdb540efd
-
C:\Users\Admin\AppData\Local\Temp\IEeHCa.txtFilesize
1.4MB
MD521e8502d416221b2d998133680b8f2b6
SHA13efa1f38b2f151cc55cd632a325e888ed262dca6
SHA256caf2a70ee7b1300b0b88cbe2a594cc0a959f8b1b043c668fde9c20961d60d64f
SHA51259e88fc5d4c3ddc784daed2ed2e415c86ce4f922bba30b8131aed48a674233593dc23398c8cde8e82a88fa6cd70dd916905530107a547fb34f158b9bdb540efd
-
memory/8-132-0x0000000000000000-mapping.dmp
-
memory/8-135-0x00000000022E0000-0x0000000002450000-memory.dmpFilesize
1.4MB
-
memory/3396-136-0x0000000000000000-mapping.dmp
-
memory/3396-139-0x0000000002320000-0x0000000002490000-memory.dmpFilesize
1.4MB
-
memory/4452-130-0x0000000000000000-mapping.dmp