danabot | 0aeeb111c81dafbc811eb60611cd5f3e20ce5c1432bb2f2be1f2f479d60408ea

Analysis

max time kernel
300s
max time network
270s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-09-2022 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0AEEB111C81DAFBC811EB60611CD5F3E20CE5C1432BB2F2BE1F2F479D60408EA.exe
Size

1.9MB
MD5

1c2f7f44ed456f2cf982339121cf9cb1
SHA1

c415afad2393acc2a69c8fef086a48c8426bce14
SHA256

0aeeb111c81dafbc811eb60611cd5f3e20ce5c1432bb2f2be1f2f479d60408ea
SHA512

e73a817dd3bd2fe4b4412f89ee036669e41ca1b634a6e085cfa217da41bf56c608dacdbdbb98783abd45bd4d8bda9ce2ec91fd2279cec1262e9afd63de259387
SSDEEP

49152:6Q+JI0dm2TT1BDCliDx0tv9BrbGXsgKv5Y3PFtNYulc7wYRPSe:6Q+FRNBCkN0tO8paFvj6VdV

Score

10^/10

danabot banker collection discovery spyware stealer trojan

Malware Config

Extracted

Family

danabot

23.254.226.20:443

198.15.112.179:443

66.85.147.23:443

Attributes

embedded_hash
8AA34A6CD5B6C9D509DB2C72E1AE6D88
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 5 IoCs

flow	pid	Process
2	1292	rundll32.exe
3	1292	rundll32.exe
32	1292	rundll32.exe
36	1292	rundll32.exe
43	1292	rundll32.exe

Loads dropped DLL 6 IoCs

pid	Process
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	rundll32.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1292 set thread context of 340	1292	rundll32.exe	28
PID 1292 set thread context of 2020	1292	rundll32.exe	30
PID 1292 set thread context of 1576	1292	rundll32.exe	32

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\freebl3.dll	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\IA2Marshal.dll	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 27 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform ID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe

Modifies registry class 42 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000102054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\28CD45D38B60DB9B986BA1DD7CC33510B7AA8B17	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\28CD45D38B60DB9B986BA1DD7CC33510B7AA8B17\Blob = 03000000010000001400000028cd45d38b60db9b986ba1dd7cc33510b7aa8b172000000001000000610200003082025d308201c6a003020102020876b3ea313b5e3848300d06092a864886f70d01010b05003057311b301906035504030c12476c6162616c5369676e20526f6f742043413110300e060355040b0c07526f6f7420434131193017060355040a0c10476c6f62616c5369676e206e762d7361310b3009060355040613024245301e170d3230303932303037353835315a170d3234303931393037353835315a3057311b301906035504030c12476c6162616c5369676e20526f6f742043413110300e060355040b0c07526f6f7420434131193017060355040a0c10476c6f62616c5369676e206e762d7361310b300906035504061302424530819f300d06092a864886f70d010101050003818d0030818902818100b1f9a33ee27d6a48e752166be162f4e168e7142b4ddea7012821c126a0c14cb42d16f65dfe7ce86ff76dd5569884fadccc4c9379d3d9c9890d41a2ffcce9cb3bd133ca52bf0fa132749860350f628b8f21e1b789459e3bdcbff573c9c567ed439f2d1777d9d2b682fd7f4fd488d6c0d5d0c102020c3489d2fe6fa8f1ee7d02b30203010001a3323030300f0603551d130101ff040530030101ff301d0603551d11041630148212476c6162616c5369676e20526f6f74204341300d06092a864886f70d01010b050003818100983f2f8a726f46334874c72847a3f13577392dc20233e99031e1fca6fa3e896b31b1ec5b9b0cdefd0b41d36d15e7e28b0247e57f703c726c23639aa929bfcfcfb32e007119d771e6b16ba652221c357a16d14dcafeb41414136c17aa33e6438b8578b5ad062743a81070deffdd100494fee842d703a151b6dc8a85981f526514	rundll32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	rundll32.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
340	rundll32.exe
2020	rundll32.exe
1576	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1292	896	0AEEB111C81DAFBC811EB60611CD5F3E20CE5C1432BB2F2BE1F2F479D60408EA.exe	27
PID 896 wrote to memory of 1292	896	0AEEB111C81DAFBC811EB60611CD5F3E20CE5C1432BB2F2BE1F2F479D60408EA.exe	27
PID 896 wrote to memory of 1292	896	0AEEB111C81DAFBC811EB60611CD5F3E20CE5C1432BB2F2BE1F2F479D60408EA.exe	27
PID 896 wrote to memory of 1292	896	0AEEB111C81DAFBC811EB60611CD5F3E20CE5C1432BB2F2BE1F2F479D60408EA.exe	27
PID 896 wrote to memory of 1292	896	0AEEB111C81DAFBC811EB60611CD5F3E20CE5C1432BB2F2BE1F2F479D60408EA.exe	27
PID 896 wrote to memory of 1292	896	0AEEB111C81DAFBC811EB60611CD5F3E20CE5C1432BB2F2BE1F2F479D60408EA.exe	27
PID 896 wrote to memory of 1292	896	0AEEB111C81DAFBC811EB60611CD5F3E20CE5C1432BB2F2BE1F2F479D60408EA.exe	27
PID 1292 wrote to memory of 340	1292	rundll32.exe	28
PID 1292 wrote to memory of 340	1292	rundll32.exe	28
PID 1292 wrote to memory of 340	1292	rundll32.exe	28
PID 1292 wrote to memory of 340	1292	rundll32.exe	28
PID 1292 wrote to memory of 340	1292	rundll32.exe	28
PID 1292 wrote to memory of 2020	1292	rundll32.exe	30
PID 1292 wrote to memory of 2020	1292	rundll32.exe	30
PID 1292 wrote to memory of 2020	1292	rundll32.exe	30
PID 1292 wrote to memory of 2020	1292	rundll32.exe	30
PID 1292 wrote to memory of 2020	1292	rundll32.exe	30
PID 1292 wrote to memory of 1576	1292	rundll32.exe	32
PID 1292 wrote to memory of 1576	1292	rundll32.exe	32
PID 1292 wrote to memory of 1576	1292	rundll32.exe	32
PID 1292 wrote to memory of 1576	1292	rundll32.exe	32
PID 1292 wrote to memory of 1576	1292	rundll32.exe	32
PID 1292 wrote to memory of 1224	1292	rundll32.exe	33
PID 1292 wrote to memory of 1224	1292	rundll32.exe	33
PID 1292 wrote to memory of 1224	1292	rundll32.exe	33
PID 1292 wrote to memory of 1224	1292	rundll32.exe	33
PID 1292 wrote to memory of 596	1292	rundll32.exe	35
PID 1292 wrote to memory of 596	1292	rundll32.exe	35
PID 1292 wrote to memory of 596	1292	rundll32.exe	35
PID 1292 wrote to memory of 596	1292	rundll32.exe	35
PID 1292 wrote to memory of 1068	1292	rundll32.exe	37
PID 1292 wrote to memory of 1068	1292	rundll32.exe	37
PID 1292 wrote to memory of 1068	1292	rundll32.exe	37
PID 1292 wrote to memory of 1068	1292	rundll32.exe	37
PID 1292 wrote to memory of 1100	1292	rundll32.exe	39
PID 1292 wrote to memory of 1100	1292	rundll32.exe	39
PID 1292 wrote to memory of 1100	1292	rundll32.exe	39
PID 1292 wrote to memory of 1100	1292	rundll32.exe	39
PID 1292 wrote to memory of 548	1292	rundll32.exe	41
PID 1292 wrote to memory of 548	1292	rundll32.exe	41
PID 1292 wrote to memory of 548	1292	rundll32.exe	41
PID 1292 wrote to memory of 548	1292	rundll32.exe	41
PID 1292 wrote to memory of 1028	1292	rundll32.exe	43
PID 1292 wrote to memory of 1028	1292	rundll32.exe	43
PID 1292 wrote to memory of 1028	1292	rundll32.exe	43
PID 1292 wrote to memory of 1028	1292	rundll32.exe	43
PID 1292 wrote to memory of 1692	1292	rundll32.exe	46
PID 1292 wrote to memory of 1692	1292	rundll32.exe	46
PID 1292 wrote to memory of 1692	1292	rundll32.exe	46
PID 1292 wrote to memory of 1692	1292	rundll32.exe	46
PID 1292 wrote to memory of 1908	1292	rundll32.exe	48
PID 1292 wrote to memory of 1908	1292	rundll32.exe	48
PID 1292 wrote to memory of 1908	1292	rundll32.exe	48
PID 1292 wrote to memory of 1908	1292	rundll32.exe	48

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\0AEEB111C81DAFBC811EB60611CD5F3E20CE5C1432BB2F2BE1F2F479D60408EA.exe
"C:\Users\Admin\AppData\Local\Temp\0AEEB111C81DAFBC811EB60611CD5F3E20CE5C1432BB2F2BE1F2F479D60408EA.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll,start C:\Users\Admin\AppData\Local\Temp\0AEEB1~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - Drops desktop.ini file(s)
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1292
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18419
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:340
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18419
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2020
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18419
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll

Filesize
2.6MB

MD5
03528423ab726a2474cbfb386d14817e

SHA1
5e973a84f864e0f0313f11c7f381faf443c42017

SHA256
b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1

SHA512
866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4

Download Submit
\Program Files\Mozilla Firefox\firefox.exe

Filesize
562KB

MD5
d388df6ed5ccbf1acdeda5af2d18cb0b

SHA1
124d3c2ba93644ac6c2d7253de242b46be836692

SHA256
8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

SHA512
f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

Download Submit
\Program Files\Mozilla Firefox\firefox.exe

Filesize
562KB

MD5
d388df6ed5ccbf1acdeda5af2d18cb0b

SHA1
124d3c2ba93644ac6c2d7253de242b46be836692

SHA256
8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

SHA512
f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

Download Submit
\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll

Filesize
2.6MB

MD5
03528423ab726a2474cbfb386d14817e

SHA1
5e973a84f864e0f0313f11c7f381faf443c42017

SHA256
b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1

SHA512
866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4

Download Submit
\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll

Filesize
2.6MB

MD5
03528423ab726a2474cbfb386d14817e

SHA1
5e973a84f864e0f0313f11c7f381faf443c42017

SHA256
b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1

SHA512
866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4

Download Submit
\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll

Filesize
2.6MB

MD5
03528423ab726a2474cbfb386d14817e

SHA1
5e973a84f864e0f0313f11c7f381faf443c42017

SHA256
b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1

SHA512
866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4

Download Submit
\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll

Filesize
2.6MB

MD5
03528423ab726a2474cbfb386d14817e

SHA1
5e973a84f864e0f0313f11c7f381faf443c42017

SHA256
b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1

SHA512
866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4

Download Submit
memory/340-86-0x00000000021E0000-0x0000000002320000-memory.dmp

Filesize
1.2MB

Download
memory/340-85-0x00000000021E0000-0x0000000002320000-memory.dmp

Filesize
1.2MB

Download
memory/340-87-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download
memory/340-79-0x00000000001A0000-0x0000000000378000-memory.dmp

Filesize
1.8MB

Download
memory/340-84-0x00000000FF173CEC-mapping.dmp

Download
memory/340-88-0x00000000001A0000-0x0000000000378000-memory.dmp

Filesize
1.8MB

Download
memory/340-89-0x0000000001FF0000-0x00000000021D7000-memory.dmp

Filesize
1.9MB

Download
memory/548-121-0x0000000000000000-mapping.dmp

Download
memory/596-118-0x0000000000000000-mapping.dmp

Download
memory/896-56-0x0000000002250000-0x0000000002408000-memory.dmp

Filesize
1.7MB

Download
memory/896-54-0x0000000002250000-0x0000000002408000-memory.dmp

Filesize
1.7MB

Download
memory/896-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/896-59-0x0000000000400000-0x00000000009F1000-memory.dmp

Filesize
5.9MB

Download
memory/896-57-0x0000000002410000-0x0000000002602000-memory.dmp

Filesize
1.9MB

Download
memory/896-62-0x0000000000400000-0x00000000009F1000-memory.dmp

Filesize
5.9MB

Download
memory/896-58-0x0000000000400000-0x00000000009F1000-memory.dmp

Filesize
5.9MB

Download
memory/1028-122-0x0000000000000000-mapping.dmp

Download
memory/1068-119-0x0000000000000000-mapping.dmp

Download
memory/1100-120-0x0000000000000000-mapping.dmp

Download
memory/1224-117-0x0000000000000000-mapping.dmp

Download
memory/1292-71-0x0000000002B00000-0x000000000353B000-memory.dmp

Filesize
10.2MB

Download
memory/1292-106-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-82-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-81-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-78-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-77-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-90-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-91-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-92-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-95-0x0000000002B00000-0x000000000353B000-memory.dmp

Filesize
10.2MB

Download
memory/1292-96-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-97-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-98-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-60-0x0000000000000000-mapping.dmp

Download
memory/1292-68-0x0000000002070000-0x0000000002319000-memory.dmp

Filesize
2.7MB

Download
memory/1292-69-0x0000000002070000-0x0000000002319000-memory.dmp

Filesize
2.7MB

Download
memory/1292-70-0x0000000002070000-0x0000000002319000-memory.dmp

Filesize
2.7MB

Download
memory/1292-104-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-105-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-83-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-109-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-111-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-72-0x0000000002B00000-0x000000000353B000-memory.dmp

Filesize
10.2MB

Download
memory/1292-110-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1292-74-0x0000000002B00000-0x000000000353B000-memory.dmp

Filesize
10.2MB

Download
memory/1292-75-0x0000000002B00000-0x000000000353B000-memory.dmp

Filesize
10.2MB

Download
memory/1292-76-0x0000000002970000-0x0000000002AB0000-memory.dmp

Filesize
1.2MB

Download
memory/1576-116-0x0000000001FD0000-0x00000000021B7000-memory.dmp

Filesize
1.9MB

Download
memory/1576-114-0x00000000021C0000-0x0000000002300000-memory.dmp

Filesize
1.2MB

Download
memory/1576-113-0x00000000021C0000-0x0000000002300000-memory.dmp

Filesize
1.2MB

Download
memory/1576-112-0x00000000FFF13CEC-mapping.dmp

Download
memory/1692-125-0x0000000000000000-mapping.dmp

Download
memory/1908-126-0x0000000000000000-mapping.dmp

Download
memory/2020-103-0x0000000002100000-0x00000000022E7000-memory.dmp

Filesize
1.9MB

Download
memory/2020-101-0x0000000000460000-0x00000000005A0000-memory.dmp

Filesize
1.2MB

Download
memory/2020-100-0x0000000000460000-0x00000000005A0000-memory.dmp

Filesize
1.2MB

Download
memory/2020-99-0x00000000FFC03CEC-mapping.dmp

Download