danabot | bb11b196d32df32f5dc5f41447031a54168adfa66ba4f828f988e58260db48e0

Analysis

max time kernel
299s
max time network
293s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/09/2022, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe
Size

1.9MB
MD5

b80d607c42e36d7ef5ad0609263180f1
SHA1

c73593f3aba0038949b55388a38e09f734e907ec
SHA256

bb11b196d32df32f5dc5f41447031a54168adfa66ba4f828f988e58260db48e0
SHA512

52ef56b38a5ffac9df27801008f2acfdf0da296c826e1af016b5e57c40cc4f7a1ba1b4157667a4f1e55592aa31a0b3b1cddc0650fb415787d685003257e9ab1b
SSDEEP

24576:unbMx0o7kyBNdZBPMHObIi74MUGcKio3rLaGkLGoG8GhIGGQNC6CmTQWPLId+2GC:unKk4EHAIZdArLaGkraKlC9CAeats

Score

10^/10

danabot banker collection discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

danabot

23.254.226.20:443

198.15.112.179:443

66.85.147.23:443

Attributes

embedded_hash
8AA34A6CD5B6C9D509DB2C72E1AE6D88
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	rundll32.exe

Blocklisted process makes network request 5 IoCs

flow	pid	Process
2	1548	rundll32.exe
3	1548	rundll32.exe
34	1548	rundll32.exe
40	1548	rundll32.exe
41	1548	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	rundll32.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 2044	1548	rundll32.exe	30
PID 1548 set thread context of 1440	1548	rundll32.exe	34

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe.sig	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.cfg	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 27 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform ID	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	rundll32.exe

Modifies registry class 33 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000102054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2F4BFC6B5B4313171977D2BA043D029901648F73	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2F4BFC6B5B4313171977D2BA043D029901648F73\Blob = 0300000001000000140000002f4bfc6b5b4313171977d2ba043d029901648f732000000001000000610200003082025d308201c6a003020102020836a832d23b564b90300d06092a864886f70d01010b05003057311b301906035504030c1247716f62616c5369676e20526f6f742043413110300e060355040b0c07526f6f7420434131193017060355040a0c10476c6f62616c5369676e206e762d7361310b3009060355040613024245301e170d3230303932303038303135305a170d3234303931393038303135305a3057311b301906035504030c1247716f62616c5369676e20526f6f742043413110300e060355040b0c07526f6f7420434131193017060355040a0c10476c6f62616c5369676e206e762d7361310b300906035504061302424530819f300d06092a864886f70d010101050003818d0030818902818100c4949033f4a41e9ec328d8c657e1bd9bcbbfbe647ee01e43d654275d9846ec12d8ce07556299b5f0d910d1259028b3d8642526988cc188ace61956acd79966446f3427319c555253eb1778a4ad9a7c38160cdbf1b4b5be67295903b32c7061590fe069d6b734cd1e2e95b8762768946a4661d2ab939a0d506c72974059e17a390203010001a3323030300f0603551d130101ff040530030101ff301d0603551d1104163014821247716f62616c5369676e20526f6f74204341300d06092a864886f70d01010b0500038181007765bf9afd111d3c1314b98e3362e2c28b7e7edba87355c036da0eedcf52e1c2a3e89c60ad35a3651a264e26b7c2cae21344f72a9893f206bcb0a4772cbc72b8cb6fdbe198c79fa5febdfd17f118acd7e009ab694b75d6bb371c6178f9d9bd8b60825787405073280d6c8772b5714ae2fdcbac368ed714ea7b4ee29d769f0b81	rundll32.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	rundll32.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2044	rundll32.exe
1548	rundll32.exe
1440	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1548	1676	BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe	28
PID 1676 wrote to memory of 1548	1676	BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe	28
PID 1676 wrote to memory of 1548	1676	BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe	28
PID 1676 wrote to memory of 1548	1676	BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe	28
PID 1676 wrote to memory of 1548	1676	BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe	28
PID 1676 wrote to memory of 1548	1676	BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe	28
PID 1676 wrote to memory of 1548	1676	BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe	28
PID 1548 wrote to memory of 2044	1548	rundll32.exe	30
PID 1548 wrote to memory of 2044	1548	rundll32.exe	30
PID 1548 wrote to memory of 2044	1548	rundll32.exe	30
PID 1548 wrote to memory of 2044	1548	rundll32.exe	30
PID 1548 wrote to memory of 2044	1548	rundll32.exe	30
PID 1548 wrote to memory of 1968	1548	rundll32.exe	32
PID 1548 wrote to memory of 1968	1548	rundll32.exe	32
PID 1548 wrote to memory of 1968	1548	rundll32.exe	32
PID 1548 wrote to memory of 1968	1548	rundll32.exe	32
PID 1548 wrote to memory of 1440	1548	rundll32.exe	34
PID 1548 wrote to memory of 1440	1548	rundll32.exe	34
PID 1548 wrote to memory of 1440	1548	rundll32.exe	34
PID 1548 wrote to memory of 1440	1548	rundll32.exe	34
PID 1548 wrote to memory of 1440	1548	rundll32.exe	34
PID 1548 wrote to memory of 1676	1548	rundll32.exe	35
PID 1548 wrote to memory of 1676	1548	rundll32.exe	35
PID 1548 wrote to memory of 1676	1548	rundll32.exe	35
PID 1548 wrote to memory of 1676	1548	rundll32.exe	35
PID 1548 wrote to memory of 1180	1548	rundll32.exe	37
PID 1548 wrote to memory of 1180	1548	rundll32.exe	37
PID 1548 wrote to memory of 1180	1548	rundll32.exe	37
PID 1548 wrote to memory of 1180	1548	rundll32.exe	37
PID 1548 wrote to memory of 784	1548	rundll32.exe	39
PID 1548 wrote to memory of 784	1548	rundll32.exe	39
PID 1548 wrote to memory of 784	1548	rundll32.exe	39
PID 1548 wrote to memory of 784	1548	rundll32.exe	39
PID 1548 wrote to memory of 188	1548	rundll32.exe	41
PID 1548 wrote to memory of 188	1548	rundll32.exe	41
PID 1548 wrote to memory of 188	1548	rundll32.exe	41
PID 1548 wrote to memory of 188	1548	rundll32.exe	41
PID 1548 wrote to memory of 1956	1548	rundll32.exe	43
PID 1548 wrote to memory of 1956	1548	rundll32.exe	43
PID 1548 wrote to memory of 1956	1548	rundll32.exe	43
PID 1548 wrote to memory of 1956	1548	rundll32.exe	43
PID 1548 wrote to memory of 2036	1548	rundll32.exe	45
PID 1548 wrote to memory of 2036	1548	rundll32.exe	45
PID 1548 wrote to memory of 2036	1548	rundll32.exe	45
PID 1548 wrote to memory of 2036	1548	rundll32.exe	45
PID 1548 wrote to memory of 1076	1548	rundll32.exe	48
PID 1548 wrote to memory of 1076	1548	rundll32.exe	48
PID 1548 wrote to memory of 1076	1548	rundll32.exe	48
PID 1548 wrote to memory of 1076	1548	rundll32.exe	48

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe
"C:\Users\Admin\AppData\Local\Temp\BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll,start C:\Users\Admin\AppData\Local\Temp\BB11B1~1.EXE
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - Drops desktop.ini file(s)
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1548
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18419
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1968
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18419
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll

Filesize
2.6MB

MD5
03528423ab726a2474cbfb386d14817e

SHA1
5e973a84f864e0f0313f11c7f381faf443c42017

SHA256
b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1

SHA512
866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4

Download Submit
\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll

Filesize
2.6MB

MD5
03528423ab726a2474cbfb386d14817e

SHA1
5e973a84f864e0f0313f11c7f381faf443c42017

SHA256
b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1

SHA512
866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4

Download Submit
\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll

Filesize
2.6MB

MD5
03528423ab726a2474cbfb386d14817e

SHA1
5e973a84f864e0f0313f11c7f381faf443c42017

SHA256
b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1

SHA512
866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4

Download Submit
\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll

Filesize
2.6MB

MD5
03528423ab726a2474cbfb386d14817e

SHA1
5e973a84f864e0f0313f11c7f381faf443c42017

SHA256
b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1

SHA512
866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4

Download Submit
\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll

Filesize
2.6MB

MD5
03528423ab726a2474cbfb386d14817e

SHA1
5e973a84f864e0f0313f11c7f381faf443c42017

SHA256
b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1

SHA512
866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4

Download Submit
memory/1440-102-0x00000000020D0000-0x0000000002210000-memory.dmp

Filesize
1.2MB

Download
memory/1440-101-0x00000000020D0000-0x0000000002210000-memory.dmp

Filesize
1.2MB

Download
memory/1440-104-0x0000000001EE0000-0x00000000020C7000-memory.dmp

Filesize
1.9MB

Download
memory/1548-83-0x00000000033B0000-0x00000000034F0000-memory.dmp

Filesize
1.2MB

Download
memory/1548-99-0x00000000033B0000-0x00000000034F0000-memory.dmp

Filesize
1.2MB

Download
memory/1548-70-0x0000000001EB0000-0x0000000002159000-memory.dmp

Filesize
2.7MB

Download
memory/1548-71-0x0000000002970000-0x00000000033AB000-memory.dmp

Filesize
10.2MB

Download
memory/1548-72-0x0000000002970000-0x00000000033AB000-memory.dmp

Filesize
10.2MB

Download
memory/1548-73-0x0000000002970000-0x00000000033AB000-memory.dmp

Filesize
10.2MB

Download
memory/1548-75-0x0000000002970000-0x00000000033AB000-memory.dmp

Filesize
10.2MB

Download
memory/1548-77-0x00000000033B0000-0x00000000034F0000-memory.dmp

Filesize
1.2MB

Download
memory/1548-76-0x00000000033B0000-0x00000000034F0000-memory.dmp

Filesize
1.2MB

Download
memory/1548-78-0x00000000033B0000-0x00000000034F0000-memory.dmp

Filesize
1.2MB

Download
memory/1548-81-0x00000000033B0000-0x00000000034F0000-memory.dmp

Filesize
1.2MB

Download
memory/1548-82-0x00000000033B0000-0x00000000034F0000-memory.dmp

Filesize
1.2MB

Download
memory/1548-69-0x0000000001EB0000-0x0000000002159000-memory.dmp

Filesize
2.7MB

Download
memory/1548-68-0x0000000001EB0000-0x0000000002159000-memory.dmp

Filesize
2.7MB

Download
memory/1548-98-0x00000000033B0000-0x00000000034F0000-memory.dmp

Filesize
1.2MB

Download
memory/1548-97-0x00000000038E0000-0x0000000003A20000-memory.dmp

Filesize
1.2MB

Download
memory/1548-94-0x00000000038E0000-0x0000000003A20000-memory.dmp

Filesize
1.2MB

Download
memory/1548-93-0x00000000033B0000-0x00000000034F0000-memory.dmp

Filesize
1.2MB

Download
memory/1548-89-0x0000000002970000-0x00000000033AB000-memory.dmp

Filesize
10.2MB

Download
memory/1548-92-0x00000000033B0000-0x00000000034F0000-memory.dmp

Filesize
1.2MB

Download
memory/1676-58-0x0000000000400000-0x00000000009F1000-memory.dmp

Filesize
5.9MB

Download
memory/1676-57-0x00000000026D0000-0x00000000028C2000-memory.dmp

Filesize
1.9MB

Download
memory/1676-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1676-56-0x0000000002510000-0x00000000026C8000-memory.dmp

Filesize
1.7MB

Download
memory/1676-67-0x0000000000400000-0x00000000009F1000-memory.dmp

Filesize
5.9MB

Download
memory/1676-59-0x0000000000400000-0x00000000009F1000-memory.dmp

Filesize
5.9MB

Download
memory/1676-54-0x0000000002510000-0x00000000026C8000-memory.dmp

Filesize
1.7MB

Download
memory/2044-90-0x0000000001E20000-0x0000000002007000-memory.dmp

Filesize
1.9MB

Download
memory/2044-79-0x00000000000E0000-0x00000000002B8000-memory.dmp

Filesize
1.8MB

Download
memory/2044-85-0x0000000002010000-0x0000000002150000-memory.dmp

Filesize
1.2MB

Download
memory/2044-86-0x0000000002010000-0x0000000002150000-memory.dmp

Filesize
1.2MB

Download
memory/2044-87-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download
memory/2044-88-0x00000000000E0000-0x00000000002B8000-memory.dmp

Filesize
1.8MB

Download