Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-06-2022 22:12
Static task
static1
Behavioral task
behavioral1
Sample
95abee4d159f541d81c84f6eb33a9bba7b5d1d7293e89857390b15498e138e51.js
Resource
win7-20220414-en
General
-
Target
95abee4d159f541d81c84f6eb33a9bba7b5d1d7293e89857390b15498e138e51.js
-
Size
1.1MB
-
MD5
fe9946e628607b7d1f5b975bdd863000
-
SHA1
91fec6fb060ecb82fad71200cd75d11c8a610e40
-
SHA256
95abee4d159f541d81c84f6eb33a9bba7b5d1d7293e89857390b15498e138e51
-
SHA512
8882ef3f7629dd0372e4d03f9098c323544f7e38758ccccb0e66e3f3bccf8b90e4672a76a606c5938603d9190899894916975b1ca3ba0eaa067ed57968f682cc
Malware Config
Extracted
danabot
89.144.25.243
14.123.141.112
91.121.17.109
97.144.123.166
89.144.25.104
37.96.21.198
26.18.85.30
88.132.191.2
106.9.214.152
161.145.156.168
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dll family_danabot \Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dll family_danabot \Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dll family_danabot \Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dll family_danabot \Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dll family_danabot \Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dll family_danabot -
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 1 1744 rundll32.exe 2 1744 rundll32.exe 4 1744 rundll32.exe 5 1744 rundll32.exe 6 1744 rundll32.exe 7 1744 rundll32.exe 8 1744 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 1976 regsvr32.exe 1744 rundll32.exe 1744 rundll32.exe 1744 rundll32.exe 1744 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
wscript.exeregsvr32.exeregsvr32.exedescription pid process target process PID 1512 wrote to memory of 1732 1512 wscript.exe regsvr32.exe PID 1512 wrote to memory of 1732 1512 wscript.exe regsvr32.exe PID 1512 wrote to memory of 1732 1512 wscript.exe regsvr32.exe PID 1512 wrote to memory of 1732 1512 wscript.exe regsvr32.exe PID 1512 wrote to memory of 1732 1512 wscript.exe regsvr32.exe PID 1732 wrote to memory of 1976 1732 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 1976 1732 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 1976 1732 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 1976 1732 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 1976 1732 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 1976 1732 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 1976 1732 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1744 1976 regsvr32.exe rundll32.exe PID 1976 wrote to memory of 1744 1976 regsvr32.exe rundll32.exe PID 1976 wrote to memory of 1744 1976 regsvr32.exe rundll32.exe PID 1976 wrote to memory of 1744 1976 regsvr32.exe rundll32.exe PID 1976 wrote to memory of 1744 1976 regsvr32.exe rundll32.exe PID 1976 wrote to memory of 1744 1976 regsvr32.exe rundll32.exe PID 1976 wrote to memory of 1744 1976 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\95abee4d159f541d81c84f6eb33a9bba7b5d1d7293e89857390b15498e138e51.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\\IdkVEIfkVWId.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\\IdkVEIfkVWId.dll3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dll,f04⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dllFilesize
284KB
MD57f73b06d9a8810e735bafaab1c5cc7a5
SHA18e46c8f4a78e510c30558a25846fa3819c101f3b
SHA2567a218d6ea68caee18ad95c861d057baf0b44d593fe59e2231ed1f0916df5f1d6
SHA5123cd5253f696f54fd025981af21536888f729730246275111159e0c54036a556fa57c6af27ac156bf19f79a381de776384a5ef88472acb9496956bbad932ef9c9
-
\Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dllFilesize
284KB
MD57f73b06d9a8810e735bafaab1c5cc7a5
SHA18e46c8f4a78e510c30558a25846fa3819c101f3b
SHA2567a218d6ea68caee18ad95c861d057baf0b44d593fe59e2231ed1f0916df5f1d6
SHA5123cd5253f696f54fd025981af21536888f729730246275111159e0c54036a556fa57c6af27ac156bf19f79a381de776384a5ef88472acb9496956bbad932ef9c9
-
\Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dllFilesize
284KB
MD57f73b06d9a8810e735bafaab1c5cc7a5
SHA18e46c8f4a78e510c30558a25846fa3819c101f3b
SHA2567a218d6ea68caee18ad95c861d057baf0b44d593fe59e2231ed1f0916df5f1d6
SHA5123cd5253f696f54fd025981af21536888f729730246275111159e0c54036a556fa57c6af27ac156bf19f79a381de776384a5ef88472acb9496956bbad932ef9c9
-
\Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dllFilesize
284KB
MD57f73b06d9a8810e735bafaab1c5cc7a5
SHA18e46c8f4a78e510c30558a25846fa3819c101f3b
SHA2567a218d6ea68caee18ad95c861d057baf0b44d593fe59e2231ed1f0916df5f1d6
SHA5123cd5253f696f54fd025981af21536888f729730246275111159e0c54036a556fa57c6af27ac156bf19f79a381de776384a5ef88472acb9496956bbad932ef9c9
-
\Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dllFilesize
284KB
MD57f73b06d9a8810e735bafaab1c5cc7a5
SHA18e46c8f4a78e510c30558a25846fa3819c101f3b
SHA2567a218d6ea68caee18ad95c861d057baf0b44d593fe59e2231ed1f0916df5f1d6
SHA5123cd5253f696f54fd025981af21536888f729730246275111159e0c54036a556fa57c6af27ac156bf19f79a381de776384a5ef88472acb9496956bbad932ef9c9
-
\Users\Admin\AppData\Local\Temp\IdkVEIfkVWId.dllFilesize
284KB
MD57f73b06d9a8810e735bafaab1c5cc7a5
SHA18e46c8f4a78e510c30558a25846fa3819c101f3b
SHA2567a218d6ea68caee18ad95c861d057baf0b44d593fe59e2231ed1f0916df5f1d6
SHA5123cd5253f696f54fd025981af21536888f729730246275111159e0c54036a556fa57c6af27ac156bf19f79a381de776384a5ef88472acb9496956bbad932ef9c9
-
memory/1732-55-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmpFilesize
8KB
-
memory/1732-54-0x0000000000000000-mapping.dmp
-
memory/1744-67-0x00000000005F0000-0x0000000000645000-memory.dmpFilesize
340KB
-
memory/1744-61-0x0000000000000000-mapping.dmp
-
memory/1976-57-0x0000000000000000-mapping.dmp
-
memory/1976-60-0x0000000000330000-0x0000000000385000-memory.dmpFilesize
340KB
-
memory/1976-58-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB