Analysis
-
max time kernel
126s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
13-07-2022 12:15
Static task
static1
Behavioral task
behavioral1
Sample
prod2.exe
Resource
win7-20220414-en
General
-
Target
prod2.exe
-
Size
3.3MB
-
MD5
47a91df4426f807d660453e2efa26027
-
SHA1
1dfe200a28b8d77ad38e539d9244167f3163e50f
-
SHA256
5a887c05193d46c6ef71ea39ca0b764db4f717d5bc994c778c9d2676978f3483
-
SHA512
c0ae0c365d74fd4e88de76c7e54e183a5311bc261af24cd0322c497a09eaf6c5ab4abfd9e35efeff700ca3903f9dd24f50977f4857c605b0467e1121365d43b4
Malware Config
Extracted
danabot
100.0.0.0:5148
58.50.42.34:13886
26.18.10.2:5662
60.52.44.36:14400
-
embedded_hash
zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
-
type
loader
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 15 4232 rundll32.exe 22 4232 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4232 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5004 3656 WerFault.exe prod2.exe -
Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 4232 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
prod2.exedescription pid process target process PID 3656 wrote to memory of 4232 3656 prod2.exe rundll32.exe PID 3656 wrote to memory of 4232 3656 prod2.exe rundll32.exe PID 3656 wrote to memory of 4232 3656 prod2.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\prod2.exe"C:\Users\Admin\AppData\Local\Temp\prod2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ifduqroytee.dll,start C:\Users\Admin\AppData\Local\Temp\prod2.exe2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 141943⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 141943⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 141943⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 141943⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 5162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3656 -ip 36561⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Ifduqroytee.dllFilesize
2.9MB
MD59eaaf83b7a39a32b20bcf11f89e5e241
SHA1e237dfffc5405c9dc242958cf89e0d05fc45fd41
SHA256ef78a7edac0d62cfb157cb652cad5282b020484fdb580ccb09a0ab321296f136
SHA5120d3d743b19b373f6aa7c41c458577dc97b692019d4aef12fcad67506bbdafdbde1fda28d245cb97188e94c05f277757276eea2104269115fe0526a096da60ee2
-
C:\Users\Admin\AppData\Local\Temp\Ifduqroytee.dllFilesize
2.9MB
MD59eaaf83b7a39a32b20bcf11f89e5e241
SHA1e237dfffc5405c9dc242958cf89e0d05fc45fd41
SHA256ef78a7edac0d62cfb157cb652cad5282b020484fdb580ccb09a0ab321296f136
SHA5120d3d743b19b373f6aa7c41c458577dc97b692019d4aef12fcad67506bbdafdbde1fda28d245cb97188e94c05f277757276eea2104269115fe0526a096da60ee2
-
memory/424-167-0x0000019A4D1D0000-0x0000019A4D310000-memory.dmpFilesize
1.2MB
-
memory/424-171-0x0000019A4B840000-0x0000019A4BA23000-memory.dmpFilesize
1.9MB
-
memory/424-169-0x0000019A4B840000-0x0000019A4BA23000-memory.dmpFilesize
1.9MB
-
memory/424-168-0x0000000000580000-0x0000000000754000-memory.dmpFilesize
1.8MB
-
memory/424-166-0x0000019A4D1D0000-0x0000019A4D310000-memory.dmpFilesize
1.2MB
-
memory/424-165-0x00007FF6F2CF6890-mapping.dmp
-
memory/1096-158-0x0000000000000000-mapping.dmp
-
memory/1148-194-0x0000000000000000-mapping.dmp
-
memory/1456-157-0x0000000000000000-mapping.dmp
-
memory/2108-155-0x0000000000000000-mapping.dmp
-
memory/2144-170-0x0000000000000000-mapping.dmp
-
memory/2804-172-0x0000000000000000-mapping.dmp
-
memory/2924-181-0x0000023B47F10000-0x0000023B48050000-memory.dmpFilesize
1.2MB
-
memory/2924-184-0x0000023B46710000-0x0000023B468F3000-memory.dmpFilesize
1.9MB
-
memory/2924-182-0x0000023B46710000-0x0000023B468F3000-memory.dmpFilesize
1.9MB
-
memory/2924-180-0x0000023B47F10000-0x0000023B48050000-memory.dmpFilesize
1.2MB
-
memory/2924-179-0x00007FF6F2CF6890-mapping.dmp
-
memory/3520-195-0x000001E6D2B00000-0x000001E6D2CE3000-memory.dmpFilesize
1.9MB
-
memory/3520-193-0x000001E6D4490000-0x000001E6D45D0000-memory.dmpFilesize
1.2MB
-
memory/3520-192-0x000001E6D4490000-0x000001E6D45D0000-memory.dmpFilesize
1.2MB
-
memory/3520-191-0x00007FF6F2CF6890-mapping.dmp
-
memory/3656-136-0x0000000000400000-0x0000000000944000-memory.dmpFilesize
5.3MB
-
memory/3656-131-0x0000000002920000-0x0000000002C70000-memory.dmpFilesize
3.3MB
-
memory/3656-130-0x00000000025FC000-0x000000000291B000-memory.dmpFilesize
3.1MB
-
memory/3656-132-0x0000000000400000-0x0000000000944000-memory.dmpFilesize
5.3MB
-
memory/4232-164-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-162-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-148-0x0000000002670000-0x0000000002916000-memory.dmpFilesize
2.6MB
-
memory/4232-137-0x0000000002670000-0x0000000002916000-memory.dmpFilesize
2.6MB
-
memory/4232-149-0x00000000032A0000-0x0000000003CFD000-memory.dmpFilesize
10.4MB
-
memory/4232-133-0x0000000000000000-mapping.dmp
-
memory/4232-150-0x00000000032A0000-0x0000000003CFD000-memory.dmpFilesize
10.4MB
-
memory/4232-173-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-174-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-175-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-176-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-177-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-178-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-154-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-163-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-147-0x00000000028CB000-0x00000000028CF000-memory.dmpFilesize
16KB
-
memory/4232-161-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-153-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-160-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-185-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-186-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-187-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-188-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-189-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-190-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-159-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-151-0x00000000032A0000-0x0000000003CFD000-memory.dmpFilesize
10.4MB
-
memory/4232-152-0x0000000003F00000-0x0000000004040000-memory.dmpFilesize
1.2MB
-
memory/4232-156-0x00000000032A0000-0x0000000003CFD000-memory.dmpFilesize
10.4MB
-
memory/4688-183-0x0000000000000000-mapping.dmp