Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    71s
  • max time network
    92s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/09/2022, 09:43

General

  • Target

    57ff8b095742c37f4e1308be1544a7b92e065bbfd63055b2f43764629e4af47a.exe

  • Size

    2.4MB

  • MD5

    f229b94308e9900d6834de7db885651d

  • SHA1

    024f195118bf5452c5e3da5a6915768295ae20cf

  • SHA256

    57ff8b095742c37f4e1308be1544a7b92e065bbfd63055b2f43764629e4af47a

  • SHA512

    f8465ce188a2f9130fd4660f37e1f1125a4745c95f4452be2cbee2555c7b56b9ac8825e22ec63eef2bcc746a81378391ce2230b22ada984dfd65f2cbd0145b3b

  • SSDEEP

    49152:MzCGyhEJd+kX7KWTq27R66+DTItNSlzlygePIq50rJm+lX3:MWGyinrKUvt6pDTVlRyPlkdX3

Malware Config

Extracted

Family

danabot

C2

153.92.223.225:443

198.15.112.179:443

185.62.56.245:443

66.85.147.23:443

Attributes
  • embedded_hash

    61A1CB063216C13FFD2E15D7F3F515E2

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 44 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57ff8b095742c37f4e1308be1544a7b92e065bbfd63055b2f43764629e4af47a.exe
    "C:\Users\Admin\AppData\Local\Temp\57ff8b095742c37f4e1308be1544a7b92e065bbfd63055b2f43764629e4af47a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Pedeuesu.dll,start C:\Users\Admin\AppData\Local\Temp\57FF8B~1.EXE
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:2216
      • C:\Windows\syswow64\rundll32.exe
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        3⤵
        • Accesses Microsoft Outlook accounts
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • outlook_office_path
        • outlook_win_path
        PID:64

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8757935e-b863-42bf-af21-285a935a7fd9\3950266016.pri

    Filesize

    3KB

    MD5

    2bf467eb5b9849766bbeaf369f660932

    SHA1

    379ecc09f68d991e26b042e05733249f24abf6f1

    SHA256

    d94477eb5e0e2211a80cceeaaa6e4ca2d3a2fa601399a3c3d305b91c79f729fb

    SHA512

    a61ee3201065c8e6a486d7e51273ff753364af636247cb7181fa92d0c21a60e76b5c7b46a21cd6e0c6b8de7b32f92738129983e7ccb7ac992cd1061b4aa33f98

  • C:\Users\Admin\AppData\Local\Temp\Pedeuesu.dll

    Filesize

    3.4MB

    MD5

    0a4be075ff7c43377937669f2e6c040a

    SHA1

    d097e78537fa7876757256583a47024bf0006fd6

    SHA256

    351342c60677616c25d8869362ba951102519c9df9761d049a55409fe51387bf

    SHA512

    cd9b365a889d36ab480ca1ab4f09351b84cff3f0ec26d6b0da5c82507435d9b9b84d835e17b1d41ac73815513dfa7082615719cf388c05f8f4abdf7d8e449e2c

  • C:\Users\Admin\AppData\Local\Temp\Tuturhssep.tmp

    Filesize

    3.1MB

    MD5

    383f37499db8755bc905cef05b7b3880

    SHA1

    2adcf085c023c2e5e26f0801a3c6f0979b3a83bb

    SHA256

    4ccd892db7a892251931d4fc98ae55009302ac65d39bdf4c0df11ccd819dc380

    SHA512

    9c70e1a2ffa1433abd143535aa482b37b56be93f98d30a64fade35c18ba185bffa9748b3ced10e8d369028dd7e5ed15dec60e68ea332dbcc60fb9727002873bc

  • C:\Users\Admin\AppData\Local\Temp\adb5b809-dcd8-4d1f-89b5-ac5f00a9179c\1253081315.pri

    Filesize

    3KB

    MD5

    68b2d64b878603ee02fcebb9899c38e1

    SHA1

    fb517f2c2a85e6dc1d78096e8f92dbd860bccb48

    SHA256

    ceb103d831d43292b43e7c04016f586f89f7b6ca382905c51399e6fe13e471c6

    SHA512

    0e6db2b4484db790fc8ebeeee1d073986e4971766927d2ff4f7bcb08ec66e30a16a80d03b6866748fbbc91a59b0f11afb241ee9bb3b4d8783222c83a3e16e6fd

  • C:\Users\Admin\AppData\Local\Temp\sa.9WZDNCRCWFTB_0_0010_.Public.InstallAgent.dat

    Filesize

    65KB

    MD5

    dc7e6cc5a47edc01738a38ad70f9a8b3

    SHA1

    c07046f0a19ad63d830fc97b6d9a79c3ede32f42

    SHA256

    34d45b244945e8c37900145bb52afc763074b301ca5153d369ddb900199fccca

    SHA512

    8ac5a5ba64c70e608b5cef3e06aca9f7bc9a9da0a9e4c9527a1b24384109306b4e93f2e1cb19375fef7c972ee9ec15361d4b34bb0eb7f97d93c4d836a6a93f10

  • C:\Users\Admin\AppData\Local\Temp\sa.9WZDNCRFHV4V_0_0010_.Public.InstallAgent.dat

    Filesize

    72KB

    MD5

    021c1a52dccc80335fe8fb388a296edc

    SHA1

    18f9e579b8b07a8b27185f9ad16e947859e23db2

    SHA256

    93d2847cfa4e1326db6448b4dc363564d8dbc0e13978a4e709abc21aa7502d5d

    SHA512

    40ae980a23fb9302d2cdc5629b0034f1ba2004c55463851aac6c0b4f73e1d1e9db36a214783454b8acd2061db8b22ea01c2cd3645e5bcc2437bf0b5fe510d6c3

  • \Users\Admin\AppData\Local\Temp\Pedeuesu.dll

    Filesize

    3.4MB

    MD5

    0a4be075ff7c43377937669f2e6c040a

    SHA1

    d097e78537fa7876757256583a47024bf0006fd6

    SHA256

    351342c60677616c25d8869362ba951102519c9df9761d049a55409fe51387bf

    SHA512

    cd9b365a889d36ab480ca1ab4f09351b84cff3f0ec26d6b0da5c82507435d9b9b84d835e17b1d41ac73815513dfa7082615719cf388c05f8f4abdf7d8e449e2c

  • memory/64-361-0x0000000004EB0000-0x00000000058D3000-memory.dmp

    Filesize

    10.1MB

  • memory/64-360-0x0000000002E00000-0x0000000003704000-memory.dmp

    Filesize

    9.0MB

  • memory/64-311-0x0000000004EB0000-0x00000000058D3000-memory.dmp

    Filesize

    10.1MB

  • memory/64-292-0x0000000002E00000-0x0000000003704000-memory.dmp

    Filesize

    9.0MB

  • memory/2216-184-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-176-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-218-0x0000000000400000-0x000000000077F000-memory.dmp

    Filesize

    3.5MB

  • memory/2216-212-0x0000000000400000-0x000000000077F000-memory.dmp

    Filesize

    3.5MB

  • memory/2216-320-0x0000000000400000-0x000000000077F000-memory.dmp

    Filesize

    3.5MB

  • memory/2216-323-0x00000000053F0000-0x0000000005E13000-memory.dmp

    Filesize

    10.1MB

  • memory/2216-186-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-185-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-183-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-182-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-181-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-180-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-179-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-178-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-241-0x00000000053F0000-0x0000000005E13000-memory.dmp

    Filesize

    10.1MB

  • memory/2216-177-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-175-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-173-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-174-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-172-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-171-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-169-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-168-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-167-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-166-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-165-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-164-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-162-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2216-161-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-138-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-139-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-158-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-157-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-163-0x0000000004E20000-0x0000000005093000-memory.dmp

    Filesize

    2.4MB

  • memory/2300-156-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-155-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-154-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-153-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-152-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-151-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-170-0x0000000000400000-0x0000000002DAE000-memory.dmp

    Filesize

    41.7MB

  • memory/2300-150-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-149-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-148-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-147-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-146-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-145-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-144-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-140-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-142-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-143-0x0000000004E20000-0x0000000005093000-memory.dmp

    Filesize

    2.4MB

  • memory/2300-141-0x0000000004BD0000-0x0000000004E11000-memory.dmp

    Filesize

    2.3MB

  • memory/2300-159-0x0000000000400000-0x0000000002DAE000-memory.dmp

    Filesize

    41.7MB

  • memory/2300-116-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-137-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-136-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-135-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-134-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-133-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-131-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-130-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-129-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-128-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-127-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-126-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-125-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-124-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-123-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-121-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-122-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-120-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-119-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-118-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-117-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB