Analysis
-
max time kernel
130s -
max time network
74s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 14:33
Static task
static1
Behavioral task
behavioral1
Sample
be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624.exe
Resource
win7-20220414-en
General
-
Target
be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624.exe
-
Size
4.4MB
-
MD5
a10d4f80ed910baeb4fd603e7b121643
-
SHA1
3716da6b25cc95a7a17c4fc2a412db52043cc4b0
-
SHA256
be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624
-
SHA512
fa6d059476a193e9b85516df678d99139d0c73f00f38217ceef4f49d290b498385c735e0d8dbc49c618e4b62fa7dbf39a85a614505b7a8fca4136e16e0ac7b31
Malware Config
Extracted
danabot
1732
3
108.62.118.103:443
23.226.132.92:443
104.144.64.163:443
108.62.141.152:443
-
embedded_hash
49574F66CD0103BBD725C08A9805C2BE
-
type
main
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
RUNDLL32.EXEflow pid process 1 1252 RUNDLL32.EXE 2 1252 RUNDLL32.EXE 5 1252 RUNDLL32.EXE 9 1252 RUNDLL32.EXE -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 860 rundll32.exe -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exeRUNDLL32.EXEpid process 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 1252 RUNDLL32.EXE 1252 RUNDLL32.EXE 1252 RUNDLL32.EXE 1252 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
RUNDLL32.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini RUNDLL32.EXE File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini RUNDLL32.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exeRUNDLL32.EXEdescription pid process Token: SeDebugPrivilege 860 rundll32.exe Token: SeDebugPrivilege 1252 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624.exerundll32.exedescription pid process target process PID 1872 wrote to memory of 860 1872 be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624.exe rundll32.exe PID 1872 wrote to memory of 860 1872 be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624.exe rundll32.exe PID 1872 wrote to memory of 860 1872 be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624.exe rundll32.exe PID 1872 wrote to memory of 860 1872 be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624.exe rundll32.exe PID 1872 wrote to memory of 860 1872 be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624.exe rundll32.exe PID 1872 wrote to memory of 860 1872 be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624.exe rundll32.exe PID 1872 wrote to memory of 860 1872 be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624.exe rundll32.exe PID 860 wrote to memory of 1252 860 rundll32.exe RUNDLL32.EXE PID 860 wrote to memory of 1252 860 rundll32.exe RUNDLL32.EXE PID 860 wrote to memory of 1252 860 rundll32.exe RUNDLL32.EXE PID 860 wrote to memory of 1252 860 rundll32.exe RUNDLL32.EXE PID 860 wrote to memory of 1252 860 rundll32.exe RUNDLL32.EXE PID 860 wrote to memory of 1252 860 rundll32.exe RUNDLL32.EXE PID 860 wrote to memory of 1252 860 rundll32.exe RUNDLL32.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624.exe"C:\Users\Admin\AppData\Local\Temp\be5050ecd867ea931bcecaafa8d10d6f8c83ab677be207a4a1332f063b3d8624.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\BE5050~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\BE5050~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\BE5050~1.DLL,bhtTjBz8Ag==3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BE5050~1.DLLFilesize
3.7MB
MD53e80a67b80152a887124c085dcb6ddda
SHA1c91e8a53e484f4adf6a4aeaad6503fe866722ba6
SHA25624b412d6681877993f2dfb6ff7e115400e8f0bde7c51b81f24b7588abe263426
SHA5129967457202f585cdb749b24af97b5e444d2898d9437c1727e59db259b2b1fc460884d58eb2462c03a0c2cc88b41c72a10c4b7de58d9ec772de0fa1eb0cf25fde
-
\Users\Admin\AppData\Local\Temp\BE5050~1.DLLFilesize
3.7MB
MD53e80a67b80152a887124c085dcb6ddda
SHA1c91e8a53e484f4adf6a4aeaad6503fe866722ba6
SHA25624b412d6681877993f2dfb6ff7e115400e8f0bde7c51b81f24b7588abe263426
SHA5129967457202f585cdb749b24af97b5e444d2898d9437c1727e59db259b2b1fc460884d58eb2462c03a0c2cc88b41c72a10c4b7de58d9ec772de0fa1eb0cf25fde
-
\Users\Admin\AppData\Local\Temp\BE5050~1.DLLFilesize
3.7MB
MD53e80a67b80152a887124c085dcb6ddda
SHA1c91e8a53e484f4adf6a4aeaad6503fe866722ba6
SHA25624b412d6681877993f2dfb6ff7e115400e8f0bde7c51b81f24b7588abe263426
SHA5129967457202f585cdb749b24af97b5e444d2898d9437c1727e59db259b2b1fc460884d58eb2462c03a0c2cc88b41c72a10c4b7de58d9ec772de0fa1eb0cf25fde
-
\Users\Admin\AppData\Local\Temp\BE5050~1.DLLFilesize
3.7MB
MD53e80a67b80152a887124c085dcb6ddda
SHA1c91e8a53e484f4adf6a4aeaad6503fe866722ba6
SHA25624b412d6681877993f2dfb6ff7e115400e8f0bde7c51b81f24b7588abe263426
SHA5129967457202f585cdb749b24af97b5e444d2898d9437c1727e59db259b2b1fc460884d58eb2462c03a0c2cc88b41c72a10c4b7de58d9ec772de0fa1eb0cf25fde
-
\Users\Admin\AppData\Local\Temp\BE5050~1.DLLFilesize
3.7MB
MD53e80a67b80152a887124c085dcb6ddda
SHA1c91e8a53e484f4adf6a4aeaad6503fe866722ba6
SHA25624b412d6681877993f2dfb6ff7e115400e8f0bde7c51b81f24b7588abe263426
SHA5129967457202f585cdb749b24af97b5e444d2898d9437c1727e59db259b2b1fc460884d58eb2462c03a0c2cc88b41c72a10c4b7de58d9ec772de0fa1eb0cf25fde
-
\Users\Admin\AppData\Local\Temp\BE5050~1.DLLFilesize
3.7MB
MD53e80a67b80152a887124c085dcb6ddda
SHA1c91e8a53e484f4adf6a4aeaad6503fe866722ba6
SHA25624b412d6681877993f2dfb6ff7e115400e8f0bde7c51b81f24b7588abe263426
SHA5129967457202f585cdb749b24af97b5e444d2898d9437c1727e59db259b2b1fc460884d58eb2462c03a0c2cc88b41c72a10c4b7de58d9ec772de0fa1eb0cf25fde
-
\Users\Admin\AppData\Local\Temp\BE5050~1.DLLFilesize
3.7MB
MD53e80a67b80152a887124c085dcb6ddda
SHA1c91e8a53e484f4adf6a4aeaad6503fe866722ba6
SHA25624b412d6681877993f2dfb6ff7e115400e8f0bde7c51b81f24b7588abe263426
SHA5129967457202f585cdb749b24af97b5e444d2898d9437c1727e59db259b2b1fc460884d58eb2462c03a0c2cc88b41c72a10c4b7de58d9ec772de0fa1eb0cf25fde
-
\Users\Admin\AppData\Local\Temp\BE5050~1.DLLFilesize
3.7MB
MD53e80a67b80152a887124c085dcb6ddda
SHA1c91e8a53e484f4adf6a4aeaad6503fe866722ba6
SHA25624b412d6681877993f2dfb6ff7e115400e8f0bde7c51b81f24b7588abe263426
SHA5129967457202f585cdb749b24af97b5e444d2898d9437c1727e59db259b2b1fc460884d58eb2462c03a0c2cc88b41c72a10c4b7de58d9ec772de0fa1eb0cf25fde
-
\Users\Admin\AppData\Local\Temp\BE5050~1.DLLFilesize
3.7MB
MD53e80a67b80152a887124c085dcb6ddda
SHA1c91e8a53e484f4adf6a4aeaad6503fe866722ba6
SHA25624b412d6681877993f2dfb6ff7e115400e8f0bde7c51b81f24b7588abe263426
SHA5129967457202f585cdb749b24af97b5e444d2898d9437c1727e59db259b2b1fc460884d58eb2462c03a0c2cc88b41c72a10c4b7de58d9ec772de0fa1eb0cf25fde
-
memory/860-56-0x0000000000000000-mapping.dmp
-
memory/860-67-0x0000000002000000-0x00000000023CB000-memory.dmpFilesize
3.8MB
-
memory/860-68-0x00000000026A0000-0x0000000002D00000-memory.dmpFilesize
6.4MB
-
memory/860-76-0x00000000026A0000-0x0000000002D00000-memory.dmpFilesize
6.4MB
-
memory/1252-78-0x00000000026A0000-0x0000000002D00000-memory.dmpFilesize
6.4MB
-
memory/1252-77-0x00000000026A0000-0x0000000002D00000-memory.dmpFilesize
6.4MB
-
memory/1252-69-0x0000000000000000-mapping.dmp
-
memory/1872-54-0x0000000005340000-0x000000000570B000-memory.dmpFilesize
3.8MB
-
memory/1872-57-0x0000000005340000-0x000000000570B000-memory.dmpFilesize
3.8MB
-
memory/1872-55-0x0000000076461000-0x0000000076463000-memory.dmpFilesize
8KB
-
memory/1872-60-0x0000000000400000-0x0000000005158000-memory.dmpFilesize
77.3MB
-
memory/1872-59-0x0000000005710000-0x0000000005AED000-memory.dmpFilesize
3.9MB
-
memory/1872-61-0x0000000000400000-0x0000000005158000-memory.dmpFilesize
77.3MB
-
memory/1872-79-0x0000000000400000-0x0000000005158000-memory.dmpFilesize
77.3MB