Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-08-2022 17:36
Static task
static1
Behavioral task
behavioral1
Sample
dana.vbs
Resource
win7-20220812-en
General
-
Target
dana.vbs
-
Size
1.4MB
-
MD5
a044c72c7f6f03fcacdd752412a03c1f
-
SHA1
bc48611b299c90d14d2847ce201fea2bb15e9a08
-
SHA256
6ac20d40a2425f1366ca2f69953f15c374b010d3738b4a430cb6f3935ef3c7c1
-
SHA512
547a89a9ea81df9527b74cbb1715d32dfc74a9b43b9e107edaea2f686c8d4a3728360b57aaa7fdc461eb3addd6e82037e6ba44e61645adfb41d802972f2eb8e2
Malware Config
Extracted
danabot
185.43.196.194
170.36.230.93
25.125.161.14
152.163.122.91
252.243.36.124
94.2.203.24
95.179.186.57
58.41.130.190
89.144.25.104
182.54.114.216
Signatures
-
Danabot x86 payload 3 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jMoOIm.dllHRasUY family_danabot C:\Users\Admin\AppData\Local\Temp\jMoOIm.dllHRasUY family_danabot C:\Users\Admin\AppData\Local\Temp\jMoOIm.dllHRasUY family_danabot -
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 23 2096 rundll32.exe 41 2096 rundll32.exe 49 2096 rundll32.exe 55 2096 rundll32.exe 60 2096 rundll32.exe 73 2096 rundll32.exe 74 2096 rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WScript.exe -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exerundll32.exepid process 2808 regsvr32.exe 2096 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
Processes:
taskmgr.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exerundll32.exetaskmgr.exepid process 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 2300 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 2300 taskmgr.exe Token: SeSystemProfilePrivilege 2300 taskmgr.exe Token: SeCreateGlobalPrivilege 2300 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe 2300 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
WScript.exeregsvr32.exeregsvr32.exedescription pid process target process PID 2232 wrote to memory of 3652 2232 WScript.exe regsvr32.exe PID 2232 wrote to memory of 3652 2232 WScript.exe regsvr32.exe PID 3652 wrote to memory of 2808 3652 regsvr32.exe regsvr32.exe PID 3652 wrote to memory of 2808 3652 regsvr32.exe regsvr32.exe PID 3652 wrote to memory of 2808 3652 regsvr32.exe regsvr32.exe PID 2808 wrote to memory of 2096 2808 regsvr32.exe rundll32.exe PID 2808 wrote to memory of 2096 2808 regsvr32.exe rundll32.exe PID 2808 wrote to memory of 2096 2808 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dana.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\\jMoOIm.dllHRasUY2⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\\jMoOIm.dllHRasUY3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\jMoOIm.dllHRasUY,f04⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2096
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2300
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3140
-
C:\Users\Admin\Desktop\n4.exe"C:\Users\Admin\Desktop\n4.exe"1⤵PID:2368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jMoOIm.dllHRasUYFilesize
460KB
MD58cfa24ff327f06f81438f02181c5b790
SHA1ccdf5f2aa6d6f920e468b89f1d45ce1cb758ff5e
SHA2566023fd184fb320359e014eb62c4ca4d673c390c58331bc3a4c1fdc49cc4ba55f
SHA512ae2da82a1c8efb4795f4c7396e52f6bb41d3b772fad5bb98287845d186d1d052d5f7532b46966e72b517dafbd5fea7e9f4b56f8dd6c76905c5b442f6f71b6e19
-
C:\Users\Admin\AppData\Local\Temp\jMoOIm.dllHRasUYFilesize
460KB
MD58cfa24ff327f06f81438f02181c5b790
SHA1ccdf5f2aa6d6f920e468b89f1d45ce1cb758ff5e
SHA2566023fd184fb320359e014eb62c4ca4d673c390c58331bc3a4c1fdc49cc4ba55f
SHA512ae2da82a1c8efb4795f4c7396e52f6bb41d3b772fad5bb98287845d186d1d052d5f7532b46966e72b517dafbd5fea7e9f4b56f8dd6c76905c5b442f6f71b6e19
-
C:\Users\Admin\AppData\Local\Temp\jMoOIm.dllHRasUYFilesize
460KB
MD58cfa24ff327f06f81438f02181c5b790
SHA1ccdf5f2aa6d6f920e468b89f1d45ce1cb758ff5e
SHA2566023fd184fb320359e014eb62c4ca4d673c390c58331bc3a4c1fdc49cc4ba55f
SHA512ae2da82a1c8efb4795f4c7396e52f6bb41d3b772fad5bb98287845d186d1d052d5f7532b46966e72b517dafbd5fea7e9f4b56f8dd6c76905c5b442f6f71b6e19
-
memory/2096-136-0x0000000000000000-mapping.dmp
-
memory/2808-134-0x0000000000000000-mapping.dmp
-
memory/3652-132-0x0000000000000000-mapping.dmp