danabot | eb97838eda74006cdf99ef30799cce33acccb1c4b217e9af9a8df3b8a7d26776

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2022, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 142KB
Sample220929-3qlmgacbf9
SHA256 eb97838eda74006cdf99ef30799cce33acccb1c4b217e9af9a8df3b8a7d26776
MD5 25eaa53bb288ab8e4c3b6e97200bf2ab
SHA1 1cc3f802af2434ec74e6493dfbe431f9eee2de07
SHA512 6ccc764a07b2db4852fc7d33ca47a1f626bc2cb83284e6efc714e0239a9c628557c7e606008c1dc684c0b9e22f21a119f850ab4e05b011b33bec8ee1304080d5
SSDEEP 3072:ZCClgMuMwR/mPv+o4oLAuFBaqsr81gzzt4eCt84:ZCzMG6R4oLPFBLc8Yzsq4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot smokeloader backdoor banker discovery trojan

Malware Config

Extracted

Family

danabot

192.236.233.188:443
23.106.124.171:443
192.119.70.159:443

Attributes

embedded_hash
A813CAF845B5703DA814AF785BB60B21
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/3284-133-0x00000000007D0000-0x00000000007D9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
88	3308	rundll32.exe
89	4420	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3656	36FE.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3656 set thread context of 4420	3656	36FE.exe	105

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\application.ini	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\blocklist.xml	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.ini	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 39 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe

Checks processor information in registry 2 TTPs 42 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	36FE.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	36FE.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	36FE.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	36FE.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	36FE.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	36FE.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	36FE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found

Modifies registry class 19 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Process not Found

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8934DF864E84E5E9F746E2167F405DF8DD5F1D0\Blob = 030000000100000014000000f8934df864e84e5e9f746e2167f405df8dd5f1d020000000010000003f0200003082023b308201a4a003020102020819fdad176bb39ddf300d06092a864886f70d01010b050030433121301f06035504030c184d696d726f736f667420526f6f7420417574686f72697479311e301c060355040b0c154d6963726f736f667420436f72706f726174696f6e301e170d3230303932393233343531335a170d3234303932383233343531335a30433121301f06035504030c184d696d726f736f667420526f6f7420417574686f72697479311e301c060355040b0c154d6963726f736f667420436f72706f726174696f6e30819f300d06092a864886f70d010101050003818d0030818902818100dd751fa2aa4c7d4af523536509681e51177732603b4b21f57fff9143694ebc049718ec5b9bab7ec102c019af078c8024c88e3e2680ac9afc6a7fcf0b59420f31bfed10b619a27515048243d4ed49f6cd4e1d52b68a5325ae3025f69756bda1619f10a28b571d34bf32a48eaf72ba8064835aad1efdc26673bc1a648810f1e5d10203010001a3383036300f0603551d130101ff040530030101ff30230603551d11041c301a82184d696d726f736f667420526f6f7420417574686f72697479300d06092a864886f70d01010b0500038181007ddb14789b6e6190380713cb51b2557e0730bd1e8ade300b78d0fa46e242c4613a976cf00856670797033fe231ea5737e4a7f5b264a2d5e91f89f8b93540568c5a5c0d992ed7aa0d01d57e966bdb1b9bd6aff6b29abf15c2d82c5817b413d795810969e4e33adad2410fd18098713c9a1cce8dc53c859297ab56ec364ccd4b8b	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8934DF864E84E5E9F746E2167F405DF8DD5F1D0	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1040	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3284	file.exe
3284	file.exe
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1040	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3284	file.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1560	svchost.exe
Token: SeShutdownPrivilege	1560	svchost.exe
Token: SeCreatePagefilePrivilege	1560	svchost.exe
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4420	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1040	Process not Found
1040	Process not Found

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 3656	1040	Process not Found	93
PID 1040 wrote to memory of 3656	1040	Process not Found	93
PID 1040 wrote to memory of 3656	1040	Process not Found	93
PID 3656 wrote to memory of 3168	3656	36FE.exe	95
PID 3656 wrote to memory of 3168	3656	36FE.exe	95
PID 3656 wrote to memory of 3168	3656	36FE.exe	95
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 3308	3656	36FE.exe	104
PID 3656 wrote to memory of 4420	3656	36FE.exe	105
PID 3656 wrote to memory of 4420	3656	36FE.exe	105
PID 3656 wrote to memory of 4420	3656	36FE.exe	105
PID 3656 wrote to memory of 4420	3656	36FE.exe	105

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3284

C:\Users\Admin\AppData\Local\Temp\36FE.exe
C:\Users\Admin\AppData\Local\Temp\36FE.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\agentactivationruntimestarter.exe
  C:\Windows\system32\agentactivationruntimestarter.exe
  2⤵
  PID:3168
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  PID:3308
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x46c 0x150
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

36FE.exe

Path C:\Users\Admin\AppData\Local\Temp\36FE.exe
Size 1.2MB
SHA256 c3a1aeaddda35d89d9b67a42bf475e9d5489fa38744f0fc4189c07f55500a1c6
MD5 ff1b4b5cd4ea43a5a2448920a04d5e7d
SHA1 7d7cf098febb776191285028afa661f85962674c
SHA512 d29a439048609b80ecb988af61a789b456a18173c66b852f09370c39c0be13d4f5ce05032d1e94c3ab045451e708ba6c8916bac7249d94e3bc3d5ae090aec3e5
SSDEEP 24576:+1nJdHdW7ZQElfy+Afx39p+2Vz9kIhru/4iu1M4oGa/2sz5TZyrM:UjHdWVQX+83n+2sIduBbvlN
MD5 SHA1 SHA512 SSDEEP

Submit Download

36FE.exe

Path C:\Users\Admin\AppData\Local\Temp\36FE.exe
Size 1.2MB
SHA256 c3a1aeaddda35d89d9b67a42bf475e9d5489fa38744f0fc4189c07f55500a1c6
MD5 ff1b4b5cd4ea43a5a2448920a04d5e7d
SHA1 7d7cf098febb776191285028afa661f85962674c
SHA512 d29a439048609b80ecb988af61a789b456a18173c66b852f09370c39c0be13d4f5ce05032d1e94c3ab045451e708ba6c8916bac7249d94e3bc3d5ae090aec3e5
SSDEEP 24576:+1nJdHdW7ZQElfy+Afx39p+2Vz9kIhru/4iu1M4oGa/2sz5TZyrM:UjHdWVQX+83n+2sIduBbvlN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pyttofehs.tmp

Path C:\Users\Admin\AppData\Local\Temp\Pyttofehs.tmp
Size 3.3MB
SHA256 39668f3125e1fb7e220f6f3566783eb6b3126c39d3b63be287172d16018accbf
MD5 2650634b147c287fe1040f3efb6e9a15
SHA1 0a4aea004ebc7d42249909cab658b09f87e4cd16
SHA512 d7634b9f01a6b055433643a04f89ce5c623879c5a8acac52beea9b0918388e7d291db541f4ce7f8b2dfb83ddbd5780b3a6fbf97579b4441e59142c812b62dc50
SSDEEP 98304:R7sRUbFsYLG/HhJitSS5XS4eKZkkI+WlSsnTYtXU:R77LG/BJgSS5X39ZxLWVn+E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3284-132-0x0000000000889000-0x000000000089A000-memory.dmp

Download

memory/3284-134-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/3284-135-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/3284-133-0x00000000007D0000-0x00000000007D9000-memory.dmp

Download

memory/3308-149-0x00000000010C0000-0x00000000010C4000-memory.dmp

Download

memory/3308-148-0x00000000010C0000-0x00000000010C4000-memory.dmp

Download

memory/3308-147-0x00000000010B0000-0x00000000010B4000-memory.dmp

Download

memory/3656-141-0x00000000024E0000-0x00000000027AE000-memory.dmp

Download

memory/3656-157-0x0000000003C80000-0x0000000003DC0000-memory.dmp

Download

memory/3656-144-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/3656-143-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/3656-142-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/3656-140-0x00000000023B8000-0x00000000024DA000-memory.dmp

Download

memory/3656-151-0x00000000031C0000-0x0000000003C77000-memory.dmp

Download

memory/3656-152-0x00000000031C0000-0x0000000003C77000-memory.dmp

Download

memory/3656-153-0x00000000031C0000-0x0000000003C77000-memory.dmp

Download

memory/3656-154-0x0000000003C80000-0x0000000003DC0000-memory.dmp

Download

memory/3656-155-0x0000000003C80000-0x0000000003DC0000-memory.dmp

Download

memory/3656-156-0x0000000003C80000-0x0000000003DC0000-memory.dmp

Download

memory/3656-145-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/3656-158-0x0000000003C80000-0x0000000003DC0000-memory.dmp

Download

memory/3656-159-0x0000000003C80000-0x0000000003DC0000-memory.dmp

Download

memory/3656-161-0x0000000003C80000-0x0000000003DC0000-memory.dmp

Download

memory/3656-169-0x00000000031C0000-0x0000000003C77000-memory.dmp

Download

memory/3656-160-0x0000000003C80000-0x0000000003DC0000-memory.dmp

Download

memory/3656-167-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/4420-164-0x0000000002A70000-0x0000000003527000-memory.dmp

Download

memory/4420-166-0x0000000003640000-0x0000000003780000-memory.dmp

Download

memory/4420-165-0x0000000003640000-0x0000000003780000-memory.dmp

Download

memory/4420-163-0x0000000000600000-0x0000000000F98000-memory.dmp

Download

memory/4420-168-0x0000000002A70000-0x0000000003527000-memory.dmp

Download