Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24-10-2022 16:16

General

  • Target

    6f692ce2932ffd7a2b81360c076c1a82092137a659c1aa80815dea98f7b2e38b.exe

  • Size

    221KB

  • MD5

    0d282dc6372a02b834d864b93a4bc1a8

  • SHA1

    5e717f0f698fd7296600a21895fb2cfbfb35e9d6

  • SHA256

    6f692ce2932ffd7a2b81360c076c1a82092137a659c1aa80815dea98f7b2e38b

  • SHA512

    29d6c69f8606a80efa559dd7cd0b69213710f3b894f89cb0e9bd50b5f4fa6f609a204ed382c78e84ce94fc7f9d518cd56b965df03f61678939d88ea474887712

  • SSDEEP

    3072:9VYIz/JSbcf8kQClyL82cow26Is+5aHNM3ULL1LaH7byghV2mh74qABCO6:9VvRSNXL82O27MxLsrJ4BR

Malware Config

Extracted

Family

danabot

C2

49.0.50.0:57

51.0.52.0:0

53.0.54.0:1200

55.0.56.0:65535

Attributes
  • embedded_hash

    569235DCA8F16ED8310BBACCB674F896

  • type

    loader

Extracted

Family

vidar

Version

55.2

Botnet

937

C2

https://t.me/slivetalks

https://c.im/@xinibin420

Attributes
  • profile_id

    937

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 37 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 22 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f692ce2932ffd7a2b81360c076c1a82092137a659c1aa80815dea98f7b2e38b.exe
    "C:\Users\Admin\AppData\Local\Temp\6f692ce2932ffd7a2b81360c076c1a82092137a659c1aa80815dea98f7b2e38b.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4368
  • C:\Users\Admin\AppData\Local\Temp\9D3.exe
    C:\Users\Admin\AppData\Local\Temp\9D3.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Windows\SysWOW64\appidtel.exe
      C:\Windows\system32\appidtel.exe
      2⤵
        PID:4576
      • C:\Windows\syswow64\rundll32.exe
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        2⤵
        • Blocklisted process makes network request
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:4840
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3700
    • C:\Users\Admin\AppData\Local\Temp\776E.exe
      C:\Users\Admin\AppData\Local\Temp\776E.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Modifies system certificate store
      PID:3364
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 2152
        2⤵
        • Program crash
        PID:992

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    2
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Credentials in Files

    3
    T1081

    Discovery

    Query Registry

    3
    T1012

    System Information Discovery

    3
    T1082

    Peripheral Device Discovery

    1
    T1120

    Collection

    Data from Local System

    3
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\65674a6f-b481-48cb-93bf-10db39452100\3516841636.pri
      Filesize

      2KB

      MD5

      6f0067066c578e540dd4276c2b8e03ae

      SHA1

      a9eef9032b9a005aa6de0d398d542f5714f3d829

      SHA256

      9cc023bd420a9582336fc2ecdb3d8d21fd7f9a3e8dfd824b5ea3266864bd6a4f

      SHA512

      db4aa55c2afbea8380ccc3302011d0945f76cde0b3d8703e8df0aea5a964a1bf65f940ec88e9fe3b98560fda5e83e13c2a47f9a8ff300accadacb11c86b94e99

    • C:\Users\Admin\AppData\Local\Temp\776E.exe
      Filesize

      332KB

      MD5

      e75ec445beb33e400201791a3fba433d

      SHA1

      a2c29449d05c2a26077e45dfcb45e37ef7c638a8

      SHA256

      f16953dfb98fb54bde6e9410883839e228ee09aa0a09892ab56a5ddfc76e7a0e

      SHA512

      4efdb748bcaef9aa1ca5bc934d5797f692a7bbd974fc675318124a4bfce62e074fd32a3033a10057a5af5cc1b9d2c7d87de316c31bce0f5b7d61983f1f967134

    • C:\Users\Admin\AppData\Local\Temp\776E.exe
      Filesize

      332KB

      MD5

      e75ec445beb33e400201791a3fba433d

      SHA1

      a2c29449d05c2a26077e45dfcb45e37ef7c638a8

      SHA256

      f16953dfb98fb54bde6e9410883839e228ee09aa0a09892ab56a5ddfc76e7a0e

      SHA512

      4efdb748bcaef9aa1ca5bc934d5797f692a7bbd974fc675318124a4bfce62e074fd32a3033a10057a5af5cc1b9d2c7d87de316c31bce0f5b7d61983f1f967134

    • C:\Users\Admin\AppData\Local\Temp\9D3.exe
      Filesize

      8.4MB

      MD5

      26b7073a5ae1ee5015cb712b883b6fae

      SHA1

      a0dd060a51a516b0413537d3bb7be78b99813359

      SHA256

      d503cb0269cd044dcd38a06cf1df7839d4045e764e2fdeae3560b97bd5155f15

      SHA512

      2a1fde5c59a4c4fb24176740d77ff22abd52b71e34bea40851728907323150f8772867337d80a9438eb0f1896c58605437440e9e2f0cb2c9ee5fec6cdb874f98

    • C:\Users\Admin\AppData\Local\Temp\9D3.exe
      Filesize

      8.4MB

      MD5

      26b7073a5ae1ee5015cb712b883b6fae

      SHA1

      a0dd060a51a516b0413537d3bb7be78b99813359

      SHA256

      d503cb0269cd044dcd38a06cf1df7839d4045e764e2fdeae3560b97bd5155f15

      SHA512

      2a1fde5c59a4c4fb24176740d77ff22abd52b71e34bea40851728907323150f8772867337d80a9438eb0f1896c58605437440e9e2f0cb2c9ee5fec6cdb874f98

    • C:\Users\Admin\AppData\Local\Temp\Syhidsduo.tmp
      Filesize

      3.3MB

      MD5

      13d0ff809f24a408728fd6fe00241020

      SHA1

      fde8484da982eceb86cf6959460ffc4ce33271a9

      SHA256

      db9190e9eb5298547a3d266f298ec1e7ede0426841da9512f2827f1e7c027520

      SHA512

      38dd1c523eb9f5aa1c3da0e95f4064f22fc191ce8cea20803c5f60fcbc40d83f5c3545529863ca18f4e65b3ea7a8eddc247ae0db11c6ffa70af560998611e768

    • C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
      Filesize

      1KB

      MD5

      ef6cba98b56b621b1e4eccf16ee4bcfa

      SHA1

      eef325df8f5120f6593ec7c14249f9bcff1fce39

      SHA256

      83550d2afd2def565036b12a57f4fb8a0e449c0abba4d8842fbf57e270f88441

      SHA512

      2f65d79cd8b9a00fa97238ade3bf7159a3487d67d2cff003d503bb11fcaade1799260b2e49ba716b514adcec8579593328a91bb7c44675df177469e328570749

    • C:\Users\Admin\AppData\Local\Temp\jawshtml.html
      Filesize

      13B

      MD5

      b2a4bc176e9f29b0c439ef9a53a62a1a

      SHA1

      1ae520cbbf7e14af867232784194366b3d1c3f34

      SHA256

      7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73

      SHA512

      e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f

    • C:\Users\Admin\AppData\Local\Temp\sa.9NBLGGH6J6VK_0_0010_.Public.InstallAgent.dat
      Filesize

      74KB

      MD5

      5cf7529165ca134ed2a5465a654b49b7

      SHA1

      7af255da7685598e6bdc1085ff39755e45aba7b8

      SHA256

      04194ee3cd35e3a9b398433516d7ec8c04d15e6ede5b95932bce44b5bf29ed08

      SHA512

      90db8db369535945c378357cc8b90e77671f9d62ad2ae1a4923dba07bc695660932d2f243e9627d61aa34e0a5409f7b977da77422ff59e35a934a65f640e37b3

    • \ProgramData\mozglue.dll
      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

    • \ProgramData\nss3.dll
      Filesize

      2.0MB

      MD5

      1cc453cdf74f31e4d913ff9c10acdde2

      SHA1

      6e85eae544d6e965f15fa5c39700fa7202f3aafe

      SHA256

      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

      SHA512

      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

    • \ProgramData\sqlite3.dll
      Filesize

      1.1MB

      MD5

      1f44d4d3087c2b202cf9c90ee9d04b0f

      SHA1

      106a3ebc9e39ab6ddb3ff987efb6527c956f192d

      SHA256

      4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260

      SHA512

      b614c72a3c1ce681ebffa628e29aa50275cc80ca9267380960c5198ea4d0a3f2df6cfb7275491d220bad72f14fc94e6656501e9a061d102fb11e00cfda2beb45

    • memory/2144-203-0x0000000003350000-0x0000000003D26000-memory.dmp
      Filesize

      9.8MB

    • memory/2144-264-0x0000000004CF0000-0x00000000057A2000-memory.dmp
      Filesize

      10.7MB

    • memory/2144-298-0x0000000000400000-0x0000000000DE1000-memory.dmp
      Filesize

      9.9MB

    • memory/2144-217-0x0000000000400000-0x0000000000DE1000-memory.dmp
      Filesize

      9.9MB

    • memory/2144-204-0x0000000000400000-0x0000000000DE1000-memory.dmp
      Filesize

      9.9MB

    • memory/2144-202-0x0000000001270000-0x0000000001AAC000-memory.dmp
      Filesize

      8.2MB

    • memory/2144-190-0x0000000000400000-0x0000000000DE1000-memory.dmp
      Filesize

      9.9MB

    • memory/2144-188-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-187-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-186-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-185-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-184-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-183-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-182-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-179-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-181-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-180-0x0000000003350000-0x0000000003D26000-memory.dmp
      Filesize

      9.8MB

    • memory/2144-178-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-177-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-176-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-174-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-175-0x0000000001270000-0x0000000001AAC000-memory.dmp
      Filesize

      8.2MB

    • memory/2144-171-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-173-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-172-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-154-0x0000000000000000-mapping.dmp
    • memory/2144-170-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-156-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-157-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-158-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-159-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-160-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-161-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-162-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-169-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-165-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-166-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-167-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/2144-168-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/3364-369-0x0000000000000000-mapping.dmp
    • memory/3364-465-0x0000000000400000-0x00000000005B1000-memory.dmp
      Filesize

      1.7MB

    • memory/3364-464-0x0000000000630000-0x000000000077A000-memory.dmp
      Filesize

      1.3MB

    • memory/3364-463-0x00000000007C1000-0x00000000007ED000-memory.dmp
      Filesize

      176KB

    • memory/3364-417-0x0000000000400000-0x00000000005B1000-memory.dmp
      Filesize

      1.7MB

    • memory/3364-416-0x0000000000630000-0x000000000077A000-memory.dmp
      Filesize

      1.3MB

    • memory/3364-415-0x00000000007C1000-0x00000000007ED000-memory.dmp
      Filesize

      176KB

    • memory/4368-116-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-121-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-146-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-142-0x0000000000780000-0x0000000000789000-memory.dmp
      Filesize

      36KB

    • memory/4368-144-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-145-0x0000000000400000-0x0000000000595000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-128-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-141-0x00000000005A0000-0x00000000006EA000-memory.dmp
      Filesize

      1.3MB

    • memory/4368-140-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-139-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-138-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-137-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-136-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-118-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-135-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-119-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-150-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-132-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-143-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-117-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-134-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-147-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-130-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-131-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-129-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-153-0x0000000000400000-0x0000000000595000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-127-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-126-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-125-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-124-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-122-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-152-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-148-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-120-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-133-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-149-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4368-151-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4576-192-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4576-191-0x0000000077520000-0x00000000776AE000-memory.dmp
      Filesize

      1.6MB

    • memory/4576-189-0x0000000000000000-mapping.dmp
    • memory/4840-261-0x0000000000B35FB0-mapping.dmp
    • memory/4840-368-0x0000000004FF0000-0x0000000005AA2000-memory.dmp
      Filesize

      10.7MB

    • memory/4840-329-0x0000000004FF0000-0x0000000005AA2000-memory.dmp
      Filesize

      10.7MB

    • memory/4840-326-0x0000000002B50000-0x00000000034E2000-memory.dmp
      Filesize

      9.6MB