Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
26-09-2022 01:52
General
-
Target
0c415967fbc5864f72e16ba41661522e559b1fa448c55ebf00bfac49de33dce2.exe
-
Size
170KB
-
MD5
893d4e27f1eeb13f20fc5e7ebfb0832d
-
SHA1
ed1585707d6d1a600bdca0123e22a7ba41a5fb4c
-
SHA256
0c415967fbc5864f72e16ba41661522e559b1fa448c55ebf00bfac49de33dce2
-
SHA512
dc8b6469477dd1ca658ebc7b3c866ed37ae159a5dd75091611b1b7b373a1a594446ab249b247e2eba3ba900c10401b4878327c018d09bf6358b233944b88af88
-
SSDEEP
3072:13q/POichgR35WFgtDhYodufaKBUtHq5x:dhHodufa5
Malware Config
Extracted
danabot
198.15.112.179:443
185.62.56.245:443
153.92.223.225:443
192.119.70.159:443
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Extracted
redline
insmix
jamesmillion2.xyz:9420
-
auth_value
f388a05524f756108c9e4b0f4c4bafb6
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Detects Smokeloader packer 1 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Deletes itself 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c415967fbc5864f72e16ba41661522e559b1fa448c55ebf00bfac49de33dce2.exe"C:\Users\Admin\AppData\Local\Temp\0c415967fbc5864f72e16ba41661522e559b1fa448c55ebf00bfac49de33dce2.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4CF7.exeC:\Users\Admin\AppData\Local\Temp\4CF7.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 6042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 6282⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\B372.exeC:\Users\Admin\AppData\Local\Temp\B372.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD593bc45aa38bbfb2f09c498121f3bf27f
SHA1ee5e89cb590d8cbc00cb2102c67d941ccce1af32
SHA25620641419ff5b85587a388f5c22caa1909cf855b60c0698a1d91d5e0d0e9f9027
SHA51229fe8329468f825ab70f6fd6405d4e9c7051ddab26d88914e27a77eddc32d44050d785b1df74d6b44f690373ee1ce1e700a3de8ac7b81cd1ff1d3f5b6a9e6513
-
Filesize
1.3MB
MD593bc45aa38bbfb2f09c498121f3bf27f
SHA1ee5e89cb590d8cbc00cb2102c67d941ccce1af32
SHA25620641419ff5b85587a388f5c22caa1909cf855b60c0698a1d91d5e0d0e9f9027
SHA51229fe8329468f825ab70f6fd6405d4e9c7051ddab26d88914e27a77eddc32d44050d785b1df74d6b44f690373ee1ce1e700a3de8ac7b81cd1ff1d3f5b6a9e6513
-
Filesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
Filesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
696KB
-
Filesize
1.6MB
-
Filesize
36KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.5MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.5MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
320KB
-
Filesize
184KB
-
Filesize
1.3MB
-
Filesize
248KB
-
Filesize
120KB
-
Filesize
472KB
-
Filesize
1.0MB
-
Filesize
1.8MB
-
Filesize
584KB
-
Filesize
408KB
-
-
Filesize
1.3MB
-
Filesize
72KB
-
Filesize
5.2MB
-
Filesize
1.6MB
-
Filesize
6.0MB
-
Filesize
300KB
-
Filesize
5.0MB
-
Filesize
192KB
-
Filesize
1.6MB
-
Filesize
220KB
-
Filesize
1.6MB
-
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.2MB
-
Filesize
2.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
-
Filesize
2.9MB
-
Filesize
2.9MB