Analysis
-
max time kernel
134s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 00:05
Static task
static1
Behavioral task
behavioral1
Sample
3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe
Resource
win7-20220414-en
General
-
Target
3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe
-
Size
5.9MB
-
MD5
1a936161249cbe295daaa2affaff158e
-
SHA1
a2f6df81c77867f2399e6b7727c7b22a0ebadbab
-
SHA256
3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06
-
SHA512
959484f87d1b6864379d5f6faa26e7202137449f275e2824d0095ff823ad8ba2ef957c1c82781e45cfda4c35104b9a573da5690473267fafb4c3bcf9daa4986a
Malware Config
Extracted
danabot
1827
3
23.81.246.201:443
23.254.225.170:443
134.119.186.216:443
23.106.123.185:443
-
embedded_hash
AEF96B4D339B580ABB737F203C2D0F52
-
type
main
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
RUNDLL32.EXEflow pid process 1 640 RUNDLL32.EXE 2 640 RUNDLL32.EXE 6 640 RUNDLL32.EXE 8 640 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 1248 rundll32.exe -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 1248 rundll32.exe 1248 rundll32.exe 1248 rundll32.exe 1248 rundll32.exe 640 RUNDLL32.EXE 640 RUNDLL32.EXE 640 RUNDLL32.EXE 640 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 3 IoCs
Processes:
RUNDLL32.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\A9INZ3MO\desktop.ini RUNDLL32.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exeRUNDLL32.EXEdescription pid process Token: SeDebugPrivilege 1248 rundll32.exe Token: SeDebugPrivilege 640 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exerundll32.exedescription pid process target process PID 1968 wrote to memory of 1248 1968 3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe rundll32.exe PID 1968 wrote to memory of 1248 1968 3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe rundll32.exe PID 1968 wrote to memory of 1248 1968 3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe rundll32.exe PID 1968 wrote to memory of 1248 1968 3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe rundll32.exe PID 1968 wrote to memory of 1248 1968 3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe rundll32.exe PID 1968 wrote to memory of 1248 1968 3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe rundll32.exe PID 1968 wrote to memory of 1248 1968 3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe rundll32.exe PID 1248 wrote to memory of 640 1248 rundll32.exe RUNDLL32.EXE PID 1248 wrote to memory of 640 1248 rundll32.exe RUNDLL32.EXE PID 1248 wrote to memory of 640 1248 rundll32.exe RUNDLL32.EXE PID 1248 wrote to memory of 640 1248 rundll32.exe RUNDLL32.EXE PID 1248 wrote to memory of 640 1248 rundll32.exe RUNDLL32.EXE PID 1248 wrote to memory of 640 1248 rundll32.exe RUNDLL32.EXE PID 1248 wrote to memory of 640 1248 rundll32.exe RUNDLL32.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe"C:\Users\Admin\AppData\Local\Temp\3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3F9365~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\3F9365~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\3F9365~1.DLL,UxY9jBwRAiQ=3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3F9365~1.DLLFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
\Users\Admin\AppData\Local\Temp\3F9365~1.DLLFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
\Users\Admin\AppData\Local\Temp\3F9365~1.DLLFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
\Users\Admin\AppData\Local\Temp\3F9365~1.DLLFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
\Users\Admin\AppData\Local\Temp\3F9365~1.DLLFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
\Users\Admin\AppData\Local\Temp\3F9365~1.DLLFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
\Users\Admin\AppData\Local\Temp\3F9365~1.DLLFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
\Users\Admin\AppData\Local\Temp\3F9365~1.DLLFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
\Users\Admin\AppData\Local\Temp\3F9365~1.DLLFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
memory/640-79-0x0000000002840000-0x0000000002E9F000-memory.dmpFilesize
6.4MB
-
memory/640-69-0x0000000000000000-mapping.dmp
-
memory/640-78-0x0000000002840000-0x0000000002E9F000-memory.dmpFilesize
6.4MB
-
memory/640-77-0x0000000002840000-0x0000000002E9F000-memory.dmpFilesize
6.4MB
-
memory/640-75-0x0000000001D90000-0x000000000234A000-memory.dmpFilesize
5.7MB
-
memory/1248-66-0x00000000021C0000-0x000000000277A000-memory.dmpFilesize
5.7MB
-
memory/1248-59-0x0000000000000000-mapping.dmp
-
memory/1248-76-0x0000000002C30000-0x000000000328F000-memory.dmpFilesize
6.4MB
-
memory/1248-68-0x0000000002C30000-0x000000000328F000-memory.dmpFilesize
6.4MB
-
memory/1968-67-0x0000000000400000-0x0000000000FC2000-memory.dmpFilesize
11.8MB
-
memory/1968-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/1968-58-0x0000000000400000-0x0000000000FC2000-memory.dmpFilesize
11.8MB
-
memory/1968-56-0x0000000002930000-0x0000000002EEB000-memory.dmpFilesize
5.7MB
-
memory/1968-57-0x0000000002EF0000-0x00000000035E4000-memory.dmpFilesize
7.0MB
-
memory/1968-54-0x0000000002930000-0x0000000002EEB000-memory.dmpFilesize
5.7MB