Analysis
-
max time kernel
71s -
max time network
92s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
09/09/2022, 09:43
Static task
static1
General
-
Target
57ff8b095742c37f4e1308be1544a7b92e065bbfd63055b2f43764629e4af47a.exe
-
Size
2.4MB
-
MD5
f229b94308e9900d6834de7db885651d
-
SHA1
024f195118bf5452c5e3da5a6915768295ae20cf
-
SHA256
57ff8b095742c37f4e1308be1544a7b92e065bbfd63055b2f43764629e4af47a
-
SHA512
f8465ce188a2f9130fd4660f37e1f1125a4745c95f4452be2cbee2555c7b56b9ac8825e22ec63eef2bcc746a81378391ce2230b22ada984dfd65f2cbd0145b3b
-
SSDEEP
49152:MzCGyhEJd+kX7KWTq27R66+DTItNSlzlygePIq50rJm+lX3:MWGyinrKUvt6pDTVlRyPlkdX3
Malware Config
Extracted
danabot
153.92.223.225:443
198.15.112.179:443
185.62.56.245:443
66.85.147.23:443
-
embedded_hash
61A1CB063216C13FFD2E15D7F3F515E2
-
type
loader
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 4 2216 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 2216 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts rundll32.exe -
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2216 set thread context of 64 2216 rundll32.exe 67 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 44 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 64 rundll32.exe 64 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 64 rundll32.exe Token: SeDebugPrivilege 64 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 64 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2216 2300 57ff8b095742c37f4e1308be1544a7b92e065bbfd63055b2f43764629e4af47a.exe 66 PID 2300 wrote to memory of 2216 2300 57ff8b095742c37f4e1308be1544a7b92e065bbfd63055b2f43764629e4af47a.exe 66 PID 2300 wrote to memory of 2216 2300 57ff8b095742c37f4e1308be1544a7b92e065bbfd63055b2f43764629e4af47a.exe 66 PID 2216 wrote to memory of 64 2216 rundll32.exe 67 PID 2216 wrote to memory of 64 2216 rundll32.exe 67 PID 2216 wrote to memory of 64 2216 rundll32.exe 67 PID 2216 wrote to memory of 64 2216 rundll32.exe 67 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57ff8b095742c37f4e1308be1544a7b92e065bbfd63055b2f43764629e4af47a.exe"C:\Users\Admin\AppData\Local\Temp\57ff8b095742c37f4e1308be1544a7b92e065bbfd63055b2f43764629e4af47a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Pedeuesu.dll,start C:\Users\Admin\AppData\Local\Temp\57FF8B~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#613⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- outlook_office_path
- outlook_win_path
PID:64
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD52bf467eb5b9849766bbeaf369f660932
SHA1379ecc09f68d991e26b042e05733249f24abf6f1
SHA256d94477eb5e0e2211a80cceeaaa6e4ca2d3a2fa601399a3c3d305b91c79f729fb
SHA512a61ee3201065c8e6a486d7e51273ff753364af636247cb7181fa92d0c21a60e76b5c7b46a21cd6e0c6b8de7b32f92738129983e7ccb7ac992cd1061b4aa33f98
-
Filesize
3.4MB
MD50a4be075ff7c43377937669f2e6c040a
SHA1d097e78537fa7876757256583a47024bf0006fd6
SHA256351342c60677616c25d8869362ba951102519c9df9761d049a55409fe51387bf
SHA512cd9b365a889d36ab480ca1ab4f09351b84cff3f0ec26d6b0da5c82507435d9b9b84d835e17b1d41ac73815513dfa7082615719cf388c05f8f4abdf7d8e449e2c
-
Filesize
3.1MB
MD5383f37499db8755bc905cef05b7b3880
SHA12adcf085c023c2e5e26f0801a3c6f0979b3a83bb
SHA2564ccd892db7a892251931d4fc98ae55009302ac65d39bdf4c0df11ccd819dc380
SHA5129c70e1a2ffa1433abd143535aa482b37b56be93f98d30a64fade35c18ba185bffa9748b3ced10e8d369028dd7e5ed15dec60e68ea332dbcc60fb9727002873bc
-
Filesize
3KB
MD568b2d64b878603ee02fcebb9899c38e1
SHA1fb517f2c2a85e6dc1d78096e8f92dbd860bccb48
SHA256ceb103d831d43292b43e7c04016f586f89f7b6ca382905c51399e6fe13e471c6
SHA5120e6db2b4484db790fc8ebeeee1d073986e4971766927d2ff4f7bcb08ec66e30a16a80d03b6866748fbbc91a59b0f11afb241ee9bb3b4d8783222c83a3e16e6fd
-
Filesize
65KB
MD5dc7e6cc5a47edc01738a38ad70f9a8b3
SHA1c07046f0a19ad63d830fc97b6d9a79c3ede32f42
SHA25634d45b244945e8c37900145bb52afc763074b301ca5153d369ddb900199fccca
SHA5128ac5a5ba64c70e608b5cef3e06aca9f7bc9a9da0a9e4c9527a1b24384109306b4e93f2e1cb19375fef7c972ee9ec15361d4b34bb0eb7f97d93c4d836a6a93f10
-
Filesize
72KB
MD5021c1a52dccc80335fe8fb388a296edc
SHA118f9e579b8b07a8b27185f9ad16e947859e23db2
SHA25693d2847cfa4e1326db6448b4dc363564d8dbc0e13978a4e709abc21aa7502d5d
SHA51240ae980a23fb9302d2cdc5629b0034f1ba2004c55463851aac6c0b4f73e1d1e9db36a214783454b8acd2061db8b22ea01c2cd3645e5bcc2437bf0b5fe510d6c3
-
Filesize
3.4MB
MD50a4be075ff7c43377937669f2e6c040a
SHA1d097e78537fa7876757256583a47024bf0006fd6
SHA256351342c60677616c25d8869362ba951102519c9df9761d049a55409fe51387bf
SHA512cd9b365a889d36ab480ca1ab4f09351b84cff3f0ec26d6b0da5c82507435d9b9b84d835e17b1d41ac73815513dfa7082615719cf388c05f8f4abdf7d8e449e2c