Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
24-09-2022 20:09
Static task
static1
General
-
Target
fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894.exe
-
Size
197KB
-
MD5
0b7bf3ba6deb48b2e850df1164806016
-
SHA1
445a721acd83c21d6528302fd00bc878a7af1af2
-
SHA256
fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894
-
SHA512
8588032b24daa25b6300536f7d532b32dd26faa75ebbd0714191fe60975d41d0cf4bdd92ec2c00bc6a92a43dbaca6729c8af83d396fed8d4c310502674386d87
-
SSDEEP
3072:+lyMELf455OA5WTxIax4XZASVcA810pELBBVKNTDKH/PkkXx:nLC5eTxIaxOAYfi0m/VKNTu
Malware Config
Extracted
danabot
198.15.112.179:443
185.62.56.245:443
153.92.223.225:443
192.119.70.159:443
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
58DE.exepid process 4044 58DE.exe -
Deletes itself 1 IoCs
Processes:
pid process 3060 -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4196 4044 WerFault.exe 58DE.exe 1360 4044 WerFault.exe 58DE.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894.exepid process 4876 fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894.exe 4876 fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894.exe 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3060 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894.exepid process 4876 fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3060 Token: SeCreatePagefilePrivilege 3060 -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
pid process 3060 -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
pid process 3060 -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
58DE.exedescription pid process target process PID 3060 wrote to memory of 4044 3060 58DE.exe PID 3060 wrote to memory of 4044 3060 58DE.exe PID 3060 wrote to memory of 4044 3060 58DE.exe PID 4044 wrote to memory of 3048 4044 58DE.exe appidtel.exe PID 4044 wrote to memory of 3048 4044 58DE.exe appidtel.exe PID 4044 wrote to memory of 3048 4044 58DE.exe appidtel.exe PID 4044 wrote to memory of 3796 4044 58DE.exe rundll32.exe PID 4044 wrote to memory of 3796 4044 58DE.exe rundll32.exe PID 4044 wrote to memory of 3796 4044 58DE.exe rundll32.exe PID 4044 wrote to memory of 3796 4044 58DE.exe rundll32.exe PID 4044 wrote to memory of 3796 4044 58DE.exe rundll32.exe PID 4044 wrote to memory of 3796 4044 58DE.exe rundll32.exe PID 4044 wrote to memory of 3796 4044 58DE.exe rundll32.exe PID 4044 wrote to memory of 3796 4044 58DE.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894.exe"C:\Users\Admin\AppData\Local\Temp\fd5a5244b9ef64a3d2dfce8fae35bf6be327c709a3f3ac05dea58b9aa8eb8894.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\58DE.exeC:\Users\Admin\AppData\Local\Temp\58DE.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 6122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 5722⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\58DE.exeFilesize
1.3MB
MD51df53e1aa831aabf9fc4ef4f7bf46b4f
SHA1905b118dfb89c9cbb2f1d0256eb1233020fd1b05
SHA256aaae59b366dc5b5e8d235e5d648d88a72f7b85f2f2aceae6a343c95aec5247b8
SHA5121298ad0f058a25bc591b98ab7d1aeeeb9765ed0421232d2758af71f1d98131eca5e642dee03190b19c75904221c03c169cf8bdbf3e6a4d2e05859d81d2ce4d25
-
C:\Users\Admin\AppData\Local\Temp\58DE.exeFilesize
1.3MB
MD51df53e1aa831aabf9fc4ef4f7bf46b4f
SHA1905b118dfb89c9cbb2f1d0256eb1233020fd1b05
SHA256aaae59b366dc5b5e8d235e5d648d88a72f7b85f2f2aceae6a343c95aec5247b8
SHA5121298ad0f058a25bc591b98ab7d1aeeeb9765ed0421232d2758af71f1d98131eca5e642dee03190b19c75904221c03c169cf8bdbf3e6a4d2e05859d81d2ce4d25
-
memory/3048-195-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/3048-194-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/3048-193-0x0000000000000000-mapping.dmp
-
memory/4044-181-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-182-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-222-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4044-210-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4044-208-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4044-162-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-206-0x0000000002410000-0x0000000002541000-memory.dmpFilesize
1.2MB
-
memory/4044-198-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4044-192-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-191-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-163-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-189-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-188-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-187-0x0000000002550000-0x000000000282B000-memory.dmpFilesize
2.9MB
-
memory/4044-186-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-185-0x0000000002410000-0x0000000002541000-memory.dmpFilesize
1.2MB
-
memory/4044-184-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-183-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-180-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-179-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-178-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-177-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-175-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-174-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-161-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-172-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-171-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-170-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-168-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-169-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-166-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-165-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-164-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-158-0x0000000000000000-mapping.dmp
-
memory/4044-190-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-160-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-173-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4044-207-0x0000000002550000-0x000000000282B000-memory.dmpFilesize
2.9MB
-
memory/4876-132-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-120-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-156-0x00000000008C6000-0x00000000008D7000-memory.dmpFilesize
68KB
-
memory/4876-155-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-154-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-153-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-152-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-151-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-125-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-150-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-149-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-148-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-142-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-146-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-145-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/4876-144-0x00000000006D0000-0x000000000081A000-memory.dmpFilesize
1.3MB
-
memory/4876-143-0x00000000008C6000-0x00000000008D7000-memory.dmpFilesize
68KB
-
memory/4876-128-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-124-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-157-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/4876-136-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-140-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-139-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-138-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-137-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-141-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-135-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-134-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-133-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-123-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-122-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-121-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-126-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-131-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-130-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-129-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-147-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB
-
memory/4876-127-0x00000000771E0000-0x000000007736E000-memory.dmpFilesize
1.6MB