Overview

overview

10

Static

static

4dc9febd77...ef.exe

windows7-x64

10

4dc9febd77...ef.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/10/2022, 16:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4dc9febd77c4f23e3420d55811af12ef.exe
  • Size 221KB
  • Sample221024-t1c9eahff4
  • SHA256 76fa9ef84067fb655ebdbe972c6c575e35a8b656ae2cf1fa7149c4b357dd86e6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
danabotsmokeloadervidar937backdoorbankerdiscoveryspywarestealertrojan

Malware Config

Extracted

Family

  • danabot

Attributes
  • embedded_hash

    569235DCA8F16ED8310BBACCB674F896

  • type

    loader

Extracted

Family

  • vidar

Version

  • 55.2

Botnet

  • 937

C2

  • https://t.me/slivetalks

  • https://c.im/@xinibin420

Attributes
  • profile_id

    937

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 39 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 53 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 21 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4dc9febd77c4f23e3420d55811af12ef.exe
    "C:\Users\Admin\AppData\Local\Temp\4dc9febd77c4f23e3420d55811af12ef.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3548
  • C:\Users\Admin\AppData\Local\Temp\59D.exe
    C:\Users\Admin\AppData\Local\Temp\59D.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Windows\SysWOW64\agentactivationruntimestarter.exe
      C:\Windows\system32\agentactivationruntimestarter.exe
      2⤵
        PID:3296
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        2⤵
        • Blocklisted process makes network request
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1884
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1484
        2⤵
        • Program crash
        PID:376
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4732
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x40c 0x2f4
      1⤵
        PID:4392
      • C:\Users\Admin\AppData\Local\Temp\C2D4.exe
        C:\Users\Admin\AppData\Local\Temp\C2D4.exe
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious use of WriteProcessMemory
        PID:1636
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\C2D4.exe" & exit
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5064
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 6
            3⤵
            • Delays execution with timeout.exe
            PID:2084
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 1976
          2⤵
          • Program crash
          PID:4408
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1636 -ip 1636
        1⤵
          PID:3972
        • C:\Windows\system32\OpenWith.exe
          C:\Windows\system32\OpenWith.exe -Embedding
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1860
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2260 -ip 2260
          1⤵
            PID:3924

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                mozglue.dll
                • Path C:\ProgramData\mozglue.dll
                • Size 593KB
                • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                nss3.dll
                • Path C:\ProgramData\nss3.dll
                • Size 2.0MB
                • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                sqlite3.dll
                • Path C:\ProgramData\sqlite3.dll
                • Size 1.1MB
                • SHA256 4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                59D.exe
                • Path C:\Users\Admin\AppData\Local\Temp\59D.exe
                • Size 8.4MB
                • SHA256 d503cb0269cd044dcd38a06cf1df7839d4045e764e2fdeae3560b97bd5155f15
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                59D.exe
                • Path C:\Users\Admin\AppData\Local\Temp\59D.exe
                • Size 8.4MB
                • SHA256 d503cb0269cd044dcd38a06cf1df7839d4045e764e2fdeae3560b97bd5155f15
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                C2D4.exe
                • Path C:\Users\Admin\AppData\Local\Temp\C2D4.exe
                • Size 332KB
                • SHA256 f16953dfb98fb54bde6e9410883839e228ee09aa0a09892ab56a5ddfc76e7a0e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                C2D4.exe
                • Path C:\Users\Admin\AppData\Local\Temp\C2D4.exe
                • Size 332KB
                • SHA256 f16953dfb98fb54bde6e9410883839e228ee09aa0a09892ab56a5ddfc76e7a0e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Syhidsduo.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Syhidsduo.tmp
                • Size 3.3MB
                • SHA256 db9190e9eb5298547a3d266f298ec1e7ede0426841da9512f2827f1e7c027520
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                chrome_installer.log
                • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                • Size 3KB
                • SHA256 40788006e1a1ef42a7c2739f7e8dd4389efe1a6b107f50580e70e8ebe5f40272
                • MD5 SHA1 SHA512
                Submit Download

                dd_vcredistUI50B8.txt
                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI50B8.txt
                • Size 11KB
                • SHA256 fd5ac2a1c3c9c587a7ed459f1ee4f8074f6643bc8557d9c8bec3c1582568c405
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                wctA1E8.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\wctA1E8.tmp
                • Size 62KB
                • SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                wctC4C7.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\wctC4C7.tmp
                • Size 62KB
                • SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/1636-156-0x0000000000400000-0x00000000005B1000-memory.dmp
                Download

                memory/1636-155-0x00000000007D3000-0x00000000007FF000-memory.dmp
                Download

                memory/1636-147-0x00000000007D3000-0x00000000007FF000-memory.dmp
                Download

                memory/1636-148-0x0000000000720000-0x0000000000769000-memory.dmp
                Download

                memory/1636-149-0x0000000000400000-0x00000000005B1000-memory.dmp
                Download

                memory/1884-171-0x0000000000C20000-0x00000000015B2000-memory.dmp
                Download

                memory/1884-181-0x0000000003020000-0x0000000003AD2000-memory.dmp
                Download

                memory/1884-175-0x0000000003C40000-0x0000000003D80000-memory.dmp
                Download

                memory/1884-174-0x0000000003C40000-0x0000000003D80000-memory.dmp
                Download

                memory/1884-173-0x0000000003020000-0x0000000003AD2000-memory.dmp
                Download

                memory/1884-172-0x0000000003020000-0x0000000003AD2000-memory.dmp
                Download

                memory/2260-167-0x0000000005A10000-0x0000000005B50000-memory.dmp
                Download

                memory/2260-160-0x0000000004D70000-0x0000000005822000-memory.dmp
                Download

                memory/2260-161-0x0000000004D70000-0x0000000005822000-memory.dmp
                Download

                memory/2260-162-0x0000000005A10000-0x0000000005B50000-memory.dmp
                Download

                memory/2260-163-0x0000000005A10000-0x0000000005B50000-memory.dmp
                Download

                memory/2260-164-0x0000000005A10000-0x0000000005B50000-memory.dmp
                Download

                memory/2260-165-0x0000000005A10000-0x0000000005B50000-memory.dmp
                Download

                memory/2260-166-0x0000000005A10000-0x0000000005B50000-memory.dmp
                Download

                memory/2260-143-0x0000000000400000-0x0000000000DE1000-memory.dmp
                Download

                memory/2260-168-0x0000000005A10000-0x0000000005B50000-memory.dmp
                Download

                memory/2260-169-0x0000000005A10000-0x0000000005B50000-memory.dmp
                Download

                memory/2260-158-0x0000000000400000-0x0000000000DE1000-memory.dmp
                Download

                memory/2260-184-0x0000000004D70000-0x0000000005822000-memory.dmp
                Download

                memory/2260-157-0x0000000000400000-0x0000000000DE1000-memory.dmp
                Download

                memory/2260-140-0x00000000012EA000-0x0000000001B25000-memory.dmp
                Download

                memory/2260-141-0x00000000032D0000-0x0000000003CA6000-memory.dmp
                Download

                memory/2260-183-0x0000000000400000-0x0000000000DE1000-memory.dmp
                Download

                memory/2260-182-0x0000000000400000-0x0000000000DE1000-memory.dmp
                Download

                memory/2260-159-0x0000000004D70000-0x0000000005822000-memory.dmp
                Download

                memory/2260-142-0x0000000000400000-0x0000000000DE1000-memory.dmp
                Download

                memory/3548-134-0x0000000000400000-0x0000000000596000-memory.dmp
                Download

                memory/3548-133-0x00000000001F0000-0x00000000001F9000-memory.dmp
                Download

                memory/3548-135-0x0000000000400000-0x0000000000596000-memory.dmp
                Download

                memory/3548-132-0x00000000008B2000-0x00000000008C2000-memory.dmp
                Download