Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 00:05
Static task
static1
Behavioral task
behavioral1
Sample
3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe
Resource
win7-20220414-en
General
-
Target
3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe
-
Size
5.9MB
-
MD5
1a936161249cbe295daaa2affaff158e
-
SHA1
a2f6df81c77867f2399e6b7727c7b22a0ebadbab
-
SHA256
3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06
-
SHA512
959484f87d1b6864379d5f6faa26e7202137449f275e2824d0095ff823ad8ba2ef957c1c82781e45cfda4c35104b9a573da5690473267fafb4c3bcf9daa4986a
Malware Config
Extracted
danabot
1827
3
23.81.246.201:443
23.254.225.170:443
134.119.186.216:443
23.106.123.185:443
-
embedded_hash
AEF96B4D339B580ABB737F203C2D0F52
-
type
main
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
RUNDLL32.EXEflow pid process 10 4724 RUNDLL32.EXE 25 4724 RUNDLL32.EXE 35 4724 RUNDLL32.EXE 38 4724 RUNDLL32.EXE -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 4728 rundll32.exe 4728 rundll32.exe 4724 RUNDLL32.EXE 4724 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3352 4696 WerFault.exe 3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exeRUNDLL32.EXEdescription pid process Token: SeDebugPrivilege 4728 rundll32.exe Token: SeDebugPrivilege 4724 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exerundll32.exedescription pid process target process PID 4696 wrote to memory of 4728 4696 3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe rundll32.exe PID 4696 wrote to memory of 4728 4696 3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe rundll32.exe PID 4696 wrote to memory of 4728 4696 3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe rundll32.exe PID 4728 wrote to memory of 4724 4728 rundll32.exe RUNDLL32.EXE PID 4728 wrote to memory of 4724 4728 rundll32.exe RUNDLL32.EXE PID 4728 wrote to memory of 4724 4728 rundll32.exe RUNDLL32.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe"C:\Users\Admin\AppData\Local\Temp\3f93657bc7af36dbba53d87baf8ec9c2126fdf1d896ff90b8504ebc2a532aa06.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3F9365~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\3F9365~1.EXE2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\3F9365~1.DLL,ZyZBZA==3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 4842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4696 -ip 46961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3F9365~1.DLLFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
C:\Users\Admin\AppData\Local\Temp\3F9365~1.EXE.dllFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
C:\Users\Admin\AppData\Local\Temp\3F9365~1.EXE.dllFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
C:\Users\Admin\AppData\Local\Temp\3F9365~1.EXE.dllFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
C:\Users\Admin\AppData\Local\Temp\3F9365~1.EXE.dllFilesize
5.7MB
MD5a28665deda765745b62e173f309928ae
SHA17446624192b1a836df97ead91c6ff105c50cf46f
SHA256d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea
SHA512091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf
-
memory/4696-145-0x0000000000400000-0x0000000000FC2000-memory.dmpFilesize
11.8MB
-
memory/4696-132-0x0000000000400000-0x0000000000FC2000-memory.dmpFilesize
11.8MB
-
memory/4696-131-0x00000000035A0000-0x0000000003C94000-memory.dmpFilesize
7.0MB
-
memory/4696-130-0x0000000002FD7000-0x0000000003592000-memory.dmpFilesize
5.7MB
-
memory/4724-148-0x0000000003530000-0x0000000003B8F000-memory.dmpFilesize
6.4MB
-
memory/4724-146-0x0000000003530000-0x0000000003B8F000-memory.dmpFilesize
6.4MB
-
memory/4724-139-0x0000000000000000-mapping.dmp
-
memory/4724-142-0x00000000027C0000-0x0000000002D7A000-memory.dmpFilesize
5.7MB
-
memory/4724-144-0x0000000003530000-0x0000000003B8F000-memory.dmpFilesize
6.4MB
-
memory/4728-137-0x0000000002170000-0x000000000272A000-memory.dmpFilesize
5.7MB
-
memory/4728-143-0x0000000002CB0000-0x000000000330F000-memory.dmpFilesize
6.4MB
-
memory/4728-138-0x0000000002CB0000-0x000000000330F000-memory.dmpFilesize
6.4MB
-
memory/4728-147-0x0000000002CB0000-0x000000000330F000-memory.dmpFilesize
6.4MB
-
memory/4728-133-0x0000000000000000-mapping.dmp