Analysis
- max time kernel
150s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
22/10/2022, 22:28
General
- Target file.exe
- Size 224KB
- Sample221022-2dmtbsfcdm
- SHA256 67f37873b31a614aaff0f134fd474843c6dcf12cf5dd41102d2c691c0b028601
Malware Config
Extracted
-
danabot
-
embedded_hash
569235DCA8F16ED8310BBACCB674F896
-
type
loader
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 10 IoCs
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\806B.exeC:\Users\Admin\AppData\Local\Temp\806B.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 6522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 9282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 9282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 10082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 10282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 9202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 10322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 11602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 10802⤵
- Program crash
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 14402⤵
- Program crash
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x508 0x5041⤵
-
C:\Users\Admin\AppData\Roaming\heajtvdC:\Users\Admin\AppData\Roaming\heajtvd1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3476 -ip 34761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3476 -ip 34761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3476 -ip 34761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3476 -ip 34761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3476 -ip 34761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3476 -ip 34761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3476 -ip 34761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3476 -ip 34761⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3476 -ip 34761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3476 -ip 34761⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
806B.exe
806B.exe
JavaDeployReg.log
Syhidsduo.tmp
b7a972bc-9460-4c6f-93c0-e6dd9473f34f.tmp
dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
dd_vcredistMSI6492.txt
wct7D63.tmp
wmsetup.log
heajtvd
heajtvd
memory/2992-152-0x0000000000400000-0x0000000002C26000-memory.dmp
memory/2992-148-0x0000000002EA3000-0x0000000002EB9000-memory.dmp
memory/2992-149-0x0000000000400000-0x0000000002C26000-memory.dmp
memory/3136-175-0x0000000003120000-0x0000000003BD2000-memory.dmp
memory/3136-168-0x0000000003BE0000-0x0000000003D20000-memory.dmp
memory/3136-169-0x0000000000C00000-0x0000000001592000-memory.dmp
memory/3136-167-0x0000000003BE0000-0x0000000003D20000-memory.dmp
memory/3136-166-0x0000000003120000-0x0000000003BD2000-memory.dmp
memory/3476-154-0x00000000073F0000-0x0000000007EA2000-memory.dmp
memory/3476-151-0x0000000000400000-0x000000000344D000-memory.dmp
memory/3476-155-0x00000000073F0000-0x0000000007EA2000-memory.dmp
memory/3476-156-0x0000000007FF0000-0x0000000008130000-memory.dmp
memory/3476-157-0x0000000007FF0000-0x0000000008130000-memory.dmp
memory/3476-158-0x0000000007FF0000-0x0000000008130000-memory.dmp
memory/3476-159-0x0000000007FF0000-0x0000000008130000-memory.dmp
memory/3476-160-0x00000000073F0000-0x0000000007EA2000-memory.dmp
memory/3476-161-0x0000000007FF0000-0x0000000008130000-memory.dmp
memory/3476-162-0x0000000007FF0000-0x0000000008130000-memory.dmp
memory/3476-164-0x0000000007FF0000-0x0000000008130000-memory.dmp
memory/3476-163-0x0000000007FF0000-0x0000000008130000-memory.dmp
memory/3476-153-0x0000000000400000-0x000000000344D000-memory.dmp
memory/3476-150-0x0000000000400000-0x000000000344D000-memory.dmp
memory/3476-145-0x0000000000400000-0x000000000344D000-memory.dmp
memory/3476-144-0x0000000005920000-0x00000000062F6000-memory.dmp
memory/3476-140-0x0000000003836000-0x0000000004071000-memory.dmp
memory/3476-142-0x0000000000400000-0x000000000344D000-memory.dmp
memory/3476-141-0x0000000005920000-0x00000000062F6000-memory.dmp
memory/3560-133-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/3560-136-0x0000000000400000-0x0000000002C26000-memory.dmp
memory/3560-135-0x0000000002D33000-0x0000000002D49000-memory.dmp
memory/3560-134-0x0000000000400000-0x0000000002C26000-memory.dmp
memory/3560-132-0x0000000002D33000-0x0000000002D49000-memory.dmp