Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
17-10-2022 13:23
Static task
static1
Behavioral task
behavioral1
Sample
Faktura.PDF.exe
Resource
win7-20220901-en
General
-
Target
Faktura.PDF.exe
-
Size
3.2MB
-
MD5
5da162eebc4d19470d96c9138eef7c1b
-
SHA1
674fae4a60d3040bf962c8ff0af5bd14bcb9ed9e
-
SHA256
3c825d5a2cc6da2b923f3bba6ba850295e0e23ca8ddad1f716d859d585c225e6
-
SHA512
08efaea6cc218b873b23727ca6f72f06460dc5b1d3ab6af2a551f5ce6d3ea796a10112c1ab88c8e82744b614b778b239eef7ed1b3805f14c9a3a96844b3535e8
-
SSDEEP
98304:tjeA5Hw2+x3MOITGA2ZgtMvhjvsSk3SU7iio:heA5H9AIythjvm3lo
Malware Config
Extracted
danabot
136.167.173.24
73.114.1.155
45.172.198.33
100.88.36.122
106.127.134.181
195.123.220.45
151.236.14.84
198.102.202.22
19.121.241.168
222.30.140.7
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Faktura.dll family_danabot \Users\Admin\AppData\Local\Temp\Faktura.dll family_danabot \Users\Admin\AppData\Local\Temp\Faktura.dll family_danabot \Users\Admin\AppData\Local\Temp\Faktura.dll family_danabot \Users\Admin\AppData\Local\Temp\Faktura.dll family_danabot \Users\Admin\AppData\Local\Temp\Faktura.dll family_danabot -
Blocklisted process makes network request 6 IoCs
Processes:
rundll32.exeflow pid process 1 1624 rundll32.exe 2 1624 rundll32.exe 4 1624 rundll32.exe 5 1624 rundll32.exe 6 1624 rundll32.exe 7 1624 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 2032 regsvr32.exe 1624 rundll32.exe 1624 rundll32.exe 1624 rundll32.exe 1624 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Faktura.PDF.exeregsvr32.exedescription pid process target process PID 1768 wrote to memory of 2032 1768 Faktura.PDF.exe regsvr32.exe PID 1768 wrote to memory of 2032 1768 Faktura.PDF.exe regsvr32.exe PID 1768 wrote to memory of 2032 1768 Faktura.PDF.exe regsvr32.exe PID 1768 wrote to memory of 2032 1768 Faktura.PDF.exe regsvr32.exe PID 1768 wrote to memory of 2032 1768 Faktura.PDF.exe regsvr32.exe PID 1768 wrote to memory of 2032 1768 Faktura.PDF.exe regsvr32.exe PID 1768 wrote to memory of 2032 1768 Faktura.PDF.exe regsvr32.exe PID 2032 wrote to memory of 1624 2032 regsvr32.exe rundll32.exe PID 2032 wrote to memory of 1624 2032 regsvr32.exe rundll32.exe PID 2032 wrote to memory of 1624 2032 regsvr32.exe rundll32.exe PID 2032 wrote to memory of 1624 2032 regsvr32.exe rundll32.exe PID 2032 wrote to memory of 1624 2032 regsvr32.exe rundll32.exe PID 2032 wrote to memory of 1624 2032 regsvr32.exe rundll32.exe PID 2032 wrote to memory of 1624 2032 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Faktura.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Faktura.PDF.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\Faktura.dll f1 C:\Users\Admin\AppData\Local\Temp\FAKTUR~1.EXE@17682⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Faktura.dll,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Faktura.dllFilesize
1.3MB
MD546129d77bca64325bf25b85b56915dd5
SHA112ff543e9cf3d1fcebbb7672457c6b5435c770e9
SHA2564a8008bcc63b512385d468be8422cdbd41e07a7a4e2c25af856a3c67297f9346
SHA512c9907742dea5ff3f489ad07f4899e5f895229e22b35946dbd9dd7831eb3f5363035b8b7d7fd0184e11edc987bdb1500e09231211da0c1c56dbce6499f3c2ed81
-
\Users\Admin\AppData\Local\Temp\Faktura.dllFilesize
1.3MB
MD546129d77bca64325bf25b85b56915dd5
SHA112ff543e9cf3d1fcebbb7672457c6b5435c770e9
SHA2564a8008bcc63b512385d468be8422cdbd41e07a7a4e2c25af856a3c67297f9346
SHA512c9907742dea5ff3f489ad07f4899e5f895229e22b35946dbd9dd7831eb3f5363035b8b7d7fd0184e11edc987bdb1500e09231211da0c1c56dbce6499f3c2ed81
-
\Users\Admin\AppData\Local\Temp\Faktura.dllFilesize
1.3MB
MD546129d77bca64325bf25b85b56915dd5
SHA112ff543e9cf3d1fcebbb7672457c6b5435c770e9
SHA2564a8008bcc63b512385d468be8422cdbd41e07a7a4e2c25af856a3c67297f9346
SHA512c9907742dea5ff3f489ad07f4899e5f895229e22b35946dbd9dd7831eb3f5363035b8b7d7fd0184e11edc987bdb1500e09231211da0c1c56dbce6499f3c2ed81
-
\Users\Admin\AppData\Local\Temp\Faktura.dllFilesize
1.3MB
MD546129d77bca64325bf25b85b56915dd5
SHA112ff543e9cf3d1fcebbb7672457c6b5435c770e9
SHA2564a8008bcc63b512385d468be8422cdbd41e07a7a4e2c25af856a3c67297f9346
SHA512c9907742dea5ff3f489ad07f4899e5f895229e22b35946dbd9dd7831eb3f5363035b8b7d7fd0184e11edc987bdb1500e09231211da0c1c56dbce6499f3c2ed81
-
\Users\Admin\AppData\Local\Temp\Faktura.dllFilesize
1.3MB
MD546129d77bca64325bf25b85b56915dd5
SHA112ff543e9cf3d1fcebbb7672457c6b5435c770e9
SHA2564a8008bcc63b512385d468be8422cdbd41e07a7a4e2c25af856a3c67297f9346
SHA512c9907742dea5ff3f489ad07f4899e5f895229e22b35946dbd9dd7831eb3f5363035b8b7d7fd0184e11edc987bdb1500e09231211da0c1c56dbce6499f3c2ed81
-
\Users\Admin\AppData\Local\Temp\Faktura.dllFilesize
1.3MB
MD546129d77bca64325bf25b85b56915dd5
SHA112ff543e9cf3d1fcebbb7672457c6b5435c770e9
SHA2564a8008bcc63b512385d468be8422cdbd41e07a7a4e2c25af856a3c67297f9346
SHA512c9907742dea5ff3f489ad07f4899e5f895229e22b35946dbd9dd7831eb3f5363035b8b7d7fd0184e11edc987bdb1500e09231211da0c1c56dbce6499f3c2ed81
-
memory/1624-64-0x0000000000000000-mapping.dmp
-
memory/1624-70-0x0000000000880000-0x00000000009E5000-memory.dmpFilesize
1.4MB
-
memory/1768-60-0x0000000000400000-0x000000000074A000-memory.dmpFilesize
3.3MB
-
memory/1768-57-0x0000000000400000-0x000000000074A000-memory.dmpFilesize
3.3MB
-
memory/1768-54-0x0000000002560000-0x00000000027B3000-memory.dmpFilesize
2.3MB
-
memory/1768-56-0x00000000027C0000-0x0000000002A10000-memory.dmpFilesize
2.3MB
-
memory/1768-55-0x0000000002560000-0x000000000271E000-memory.dmpFilesize
1.7MB
-
memory/2032-59-0x0000000076961000-0x0000000076963000-memory.dmpFilesize
8KB
-
memory/2032-58-0x0000000000000000-mapping.dmp
-
memory/2032-63-0x0000000001F50000-0x00000000020B5000-memory.dmpFilesize
1.4MB