Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
22/10/2022, 12:27
General
- Target file.exe
- Size 224KB
- Sample221022-pmspqadccn
- SHA256 ef031ae3787a3ab2fc2dcfde2857913c0f933fc29539462d174e132d314089ca
Malware Config
Extracted
-
danabot
-
49.0.50.0:57
-
51.0.52.0:0
-
53.0.54.0:1200
-
55.0.56.0:65535
-
embedded_hash
8D3A926FD67FCDCACD5CC640026959E5
-
type
loader
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 9 IoCs
- Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E266.exeC:\Users\Admin\AppData\Local\Temp\E266.exe1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 6522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 9322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 9922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 10122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 9962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 9962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 10282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 11002⤵
- Program crash
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 14322⤵
- Program crash
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x324 0x5201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4860 -ip 48601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4860 -ip 48601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4860 -ip 48601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4860 -ip 48601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4860 -ip 48601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4860 -ip 48601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4860 -ip 48601⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4860 -ip 48601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4860 -ip 48601⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
E266.exe
E266.exe
Hushfte.tmp
JavaDeployReg.log
TMKNGOMU-20220812-1924.log
dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
dd_vcredistMSI50B8.txt
dd_vcredistMSI50E6.txt
dd_vcredistUI50B8.txt
dd_vcredistUI50E6.txt
jawshtml.html
sa.9NXQXXLFST89_0__.Public.InstallAgent.dat
wct168.tmp
wct1F1D.tmp
wctC4C7.tmp
memory/948-135-0x0000000000400000-0x0000000002C26000-memory.dmp
memory/948-133-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/948-132-0x0000000002E33000-0x0000000002E49000-memory.dmp
memory/948-134-0x0000000000400000-0x0000000002C26000-memory.dmp
memory/1892-175-0x0000000000C00000-0x00000000015CE000-memory.dmp
memory/1892-176-0x0000000003040000-0x0000000003B2D000-memory.dmp
memory/1892-159-0x0000000003040000-0x0000000003B2D000-memory.dmp
memory/1892-161-0x0000000003C00000-0x0000000003D40000-memory.dmp
memory/1892-160-0x0000000003C00000-0x0000000003D40000-memory.dmp
memory/4860-143-0x0000000000400000-0x000000000345F000-memory.dmp
memory/4860-155-0x0000000008080000-0x00000000081C0000-memory.dmp
memory/4860-157-0x0000000008080000-0x00000000081C0000-memory.dmp
memory/4860-156-0x00000000072E0000-0x0000000007DCD000-memory.dmp
memory/4860-154-0x0000000008080000-0x00000000081C0000-memory.dmp
memory/4860-153-0x0000000008080000-0x00000000081C0000-memory.dmp
memory/4860-152-0x0000000008080000-0x00000000081C0000-memory.dmp
memory/4860-151-0x0000000008080000-0x00000000081C0000-memory.dmp
memory/4860-150-0x0000000008080000-0x00000000081C0000-memory.dmp
memory/4860-148-0x00000000072E0000-0x0000000007DCD000-memory.dmp
memory/4860-149-0x0000000008080000-0x00000000081C0000-memory.dmp
memory/4860-147-0x00000000072E0000-0x0000000007DCD000-memory.dmp
memory/4860-146-0x0000000000400000-0x000000000345F000-memory.dmp
memory/4860-145-0x0000000000400000-0x000000000345F000-memory.dmp
memory/4860-144-0x0000000000400000-0x000000000345F000-memory.dmp
memory/4860-142-0x0000000000400000-0x000000000345F000-memory.dmp
memory/4860-141-0x0000000005910000-0x0000000006305000-memory.dmp
memory/4860-140-0x0000000003714000-0x0000000003F62000-memory.dmp