Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    19-06-2022 18:27

General

  • Target

    CRA_INV_2019_365321426273/CRA_INV_2019_365321426273.vbs

  • Size

    23.7MB

  • MD5

    611c2bf7aa7bb62e90f3a92f3682c0b5

  • SHA1

    4a863046a56c0582ac43acabd7f465c725392799

  • SHA256

    f74001bcf33072d683af2fcd20b1e0f1902b86a33898b37df1f364c31136a4ee

  • SHA512

    24adbc4cf7ebed6ac6f5a9a08396d41af15f1d6586890d43be40dd6220f746bcd8ebf2d6bee4a8632a406842e8ece0afff4dfde2e58aabedd19ea15ee3984c60

Score
10/10

Malware Config

Extracted

Family

danabot

C2

181.63.44.194

207.148.83.108

45.77.40.71

87.115.138.169

24.229.48.7

116.111.206.27

45.196.143.203

218.65.3.199

131.59.110.186

113.81.97.96

rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CRA_INV_2019_365321426273\CRA_INV_2019_365321426273.vbs"
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1948
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\yvNdiXKm.txt
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SysWOW64\regsvr32.exe
      -s C:\Users\Admin\AppData\Local\Temp\yvNdiXKm.txt
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\yvNdiXKm.txt,f0
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:1680

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\yvNdiXKm.txt
    Filesize

    1.1MB

    MD5

    f8cf63fb5f35fb0a72aeffcf1dc27aef

    SHA1

    bcf27f65d35c4ce37f0f6af6ca3f2215fbef34eb

    SHA256

    dca1194d8f8691d90bb209e4b9baae53da4d107169bda9b1d8c4a99a6316b5b9

    SHA512

    f30acf1e157b70df459ef4d133bc680c9a7f48ddd532c29fa9d27c8eb16e976f6baf4d2f701d40a8875929267f8147dc25ee960b8b7eccc20da59eeca814dc4f

  • \Users\Admin\AppData\Local\Temp\yvNdiXKm.txt
    Filesize

    1.1MB

    MD5

    f8cf63fb5f35fb0a72aeffcf1dc27aef

    SHA1

    bcf27f65d35c4ce37f0f6af6ca3f2215fbef34eb

    SHA256

    dca1194d8f8691d90bb209e4b9baae53da4d107169bda9b1d8c4a99a6316b5b9

    SHA512

    f30acf1e157b70df459ef4d133bc680c9a7f48ddd532c29fa9d27c8eb16e976f6baf4d2f701d40a8875929267f8147dc25ee960b8b7eccc20da59eeca814dc4f

  • \Users\Admin\AppData\Local\Temp\yvNdiXKm.txt
    Filesize

    1.1MB

    MD5

    f8cf63fb5f35fb0a72aeffcf1dc27aef

    SHA1

    bcf27f65d35c4ce37f0f6af6ca3f2215fbef34eb

    SHA256

    dca1194d8f8691d90bb209e4b9baae53da4d107169bda9b1d8c4a99a6316b5b9

    SHA512

    f30acf1e157b70df459ef4d133bc680c9a7f48ddd532c29fa9d27c8eb16e976f6baf4d2f701d40a8875929267f8147dc25ee960b8b7eccc20da59eeca814dc4f

  • memory/1356-63-0x0000000001EE0000-0x000000000290A000-memory.dmp
    Filesize

    10.2MB

  • memory/1356-56-0x0000000000000000-mapping.dmp
  • memory/1356-59-0x0000000001EE0000-0x000000000290A000-memory.dmp
    Filesize

    10.2MB

  • memory/1356-61-0x0000000001EE0000-0x000000000290A000-memory.dmp
    Filesize

    10.2MB

  • memory/1356-62-0x0000000001EE0000-0x000000000204A000-memory.dmp
    Filesize

    1.4MB

  • memory/1356-57-0x0000000075401000-0x0000000075403000-memory.dmp
    Filesize

    8KB

  • memory/1680-66-0x0000000000000000-mapping.dmp
  • memory/1680-69-0x0000000001DB0000-0x00000000027DA000-memory.dmp
    Filesize

    10.2MB

  • memory/1680-71-0x0000000001DB0000-0x00000000027DA000-memory.dmp
    Filesize

    10.2MB

  • memory/1680-72-0x0000000001DB0000-0x0000000001F1A000-memory.dmp
    Filesize

    1.4MB

  • memory/1680-73-0x0000000001DB0000-0x00000000027DA000-memory.dmp
    Filesize

    10.2MB

  • memory/1680-76-0x0000000001DB0000-0x00000000027DA000-memory.dmp
    Filesize

    10.2MB

  • memory/1680-77-0x0000000001DB0000-0x00000000027DA000-memory.dmp
    Filesize

    10.2MB

  • memory/1992-54-0x000007FEFC021000-0x000007FEFC023000-memory.dmp
    Filesize

    8KB