danabot | 6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f

General

Target

6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f.exe
Size

260KB
MD5

1192b8a910b8b5514317e7cb99644cbb
SHA1

99ff20cb017f1010ece81ea0ac558c11c98cd731
SHA256

6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f
SHA512

98afbd90b46057d2b7d54cc0684c66050d615a4b2994d4afbeb2744a4c8c296caa168a76bbfecac3b1313eb1ef568f17cefec971f9efd2cd928594fa7f5b5ad7
SSDEEP

3072:+XKQEDgkW0MataObS5zlrciicAaO90PKFIagWYtHi+RpR20Kc:GhgMTataOeldkIe+5pI0

Score

10^/10

danabot smokeloader systembc backdoor banker trojan

Malware Config

Extracted

Family

danabot

C2

172.86.120.215:443

213.227.155.103:443

103.187.26.147:443

172.86.120.138:443

Attributes

embedded_hash
BBBB0DB8CB7E6D152424535822E445A7
type
loader

Extracted

Family

systembc

C2

45.182.189.231:443

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3420-136-0x0000000002D00000-0x0000000002D09000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

82 4828 rundll32.exe
83 680 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

107B.exe4A77.exempvb.exe

pid process

4892 107B.exe
4088 4A77.exe
3444 mpvb.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

107B.exe

description pid process target process

PID 4892 set thread context of 680 4892 107B.exe rundll32.exe
Drops file in Windows directory 2 IoCs

Processes:

4A77.exe

description ioc process

File created C:\Windows\Tasks\mpvb.job 4A77.exe
File opened for modification C:\Windows\Tasks\mpvb.job 4A77.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
82	4828	rundll32.exe
83	680	rundll32.exe

pid	process
4892	107B.exe
4088	4A77.exe
3444	mpvb.exe

description	pid	process	target process
PID 4892 set thread context of 680	4892	107B.exe	rundll32.exe

description	ioc	process
File created	C:\Windows\Tasks\mpvb.job	4A77.exe
File opened for modification	C:\Windows\Tasks\mpvb.job	4A77.exe

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1692	4892	WerFault.exe	107B.exe
4488	4088	WerFault.exe	4A77.exe
1488	4892	WerFault.exe	107B.exe
3548	4892	WerFault.exe	107B.exe
4200	4892	WerFault.exe	107B.exe
3728	4892	WerFault.exe	107B.exe

Checks SCSI registry key(s) 3 TTPs 39 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exe6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe

Checks processor information in registry 2 TTPs 52 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe107B.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	107B.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	107B.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	107B.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	107B.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	107B.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	107B.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	107B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	107B.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"

Modifies registry class 19 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pid process

3068

pid	process
3068

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f.exe

pid	process
3420	6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f.exe
3420	6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f.exe
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3068
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f.exe

pid process

3420 6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f.exe

pid	process
3068

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	1940	svchost.exe
Token: SeShutdownPrivilege	1940	svchost.exe
Token: SeCreatePagefilePrivilege	1940	svchost.exe
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

680 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pid process

3068
3068

pid	process
680	rundll32.exe

pid	process
3068
3068

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

107B.exe

description	pid	process	target process
PID 3068 wrote to memory of 4892	3068		107B.exe
PID 3068 wrote to memory of 4892	3068		107B.exe
PID 3068 wrote to memory of 4892	3068		107B.exe
PID 4892 wrote to memory of 4460	4892	107B.exe	agentactivationruntimestarter.exe
PID 4892 wrote to memory of 4460	4892	107B.exe	agentactivationruntimestarter.exe
PID 4892 wrote to memory of 4460	4892	107B.exe	agentactivationruntimestarter.exe
PID 3068 wrote to memory of 4088	3068		4A77.exe
PID 3068 wrote to memory of 4088	3068		4A77.exe
PID 3068 wrote to memory of 4088	3068		4A77.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 4828	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 680	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 680	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 680	4892	107B.exe	rundll32.exe
PID 4892 wrote to memory of 680	4892	107B.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f.exe
"C:\Users\Admin\AppData\Local\Temp\6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3420

C:\Users\Admin\AppData\Local\Temp\107B.exe
C:\Users\Admin\AppData\Local\Temp\107B.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\SysWOW64\agentactivationruntimestarter.exe
C:\Windows\system32\agentactivationruntimestarter.exe
2⤵
PID:4460

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
2⤵
- Blocklisted process makes network request
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 628
2⤵
- Program crash
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 924
2⤵
- Program crash
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 924
2⤵
- Program crash
PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 1068
2⤵
- Program crash
PID:4200

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
2⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 964
2⤵
- Program crash
PID:3728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x38c
1⤵
PID:3796

C:\Users\Admin\AppData\Local\Temp\4A77.exe
C:\Users\Admin\AppData\Local\Temp\4A77.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 960
2⤵
- Program crash
PID:4488

C:\ProgramData\weixo\mpvb.exe
C:\ProgramData\weixo\mpvb.exe start
1⤵
- Executes dropped EXE
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4892 -ip 4892
1⤵
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4088 -ip 4088
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4892 -ip 4892
1⤵
PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4892 -ip 4892
1⤵
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4892 -ip 4892
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4892 -ip 4892
1⤵
PID:3452

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\weixo\mpvb.exe
Filesize
255KB

MD5
cd7f488588b891094c27999d19388be9

SHA1
8f6d5e96247d0bd8c04842727f08b9fdaf879d06

SHA256
2a9262660a612c10017d661e2cd82a2e1dabef943542e83bc0f72426622a761a

SHA512
b8d90f7b60d90d269239da9b8845d84e546da2135aa3f444e84efd52b347cc96d46440ed2f728489e281ffad1cf220697c6bfa57137c9f3e44632102a408d188

Download Submit
C:\ProgramData\weixo\mpvb.exe
Filesize
255KB

MD5
cd7f488588b891094c27999d19388be9

SHA1
8f6d5e96247d0bd8c04842727f08b9fdaf879d06

SHA256
2a9262660a612c10017d661e2cd82a2e1dabef943542e83bc0f72426622a761a

SHA512
b8d90f7b60d90d269239da9b8845d84e546da2135aa3f444e84efd52b347cc96d46440ed2f728489e281ffad1cf220697c6bfa57137c9f3e44632102a408d188

Download Submit
C:\Users\Admin\AppData\Local\Temp\107B.exe
Filesize
1.3MB

MD5
e149b772abb24bd7a8c52d040aa5cb28

SHA1
fe1cd144e31c2052cea5d30c3363a08a4cdd958c

SHA256
dbc1cb66916359beec89171f1e3b964ff662f06dc679caa2a386d3a1984be3bd

SHA512
43aabe646bbd496e07bbbd2833a98ee1f21c70c2c842749a8029849860e9f6893d6c09a3507042c0e6ad4c6835b3913eebcc31afcf7ff96afd26760c34da9cdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\107B.exe
Filesize
1.3MB

MD5
e149b772abb24bd7a8c52d040aa5cb28

SHA1
fe1cd144e31c2052cea5d30c3363a08a4cdd958c

SHA256
dbc1cb66916359beec89171f1e3b964ff662f06dc679caa2a386d3a1984be3bd

SHA512
43aabe646bbd496e07bbbd2833a98ee1f21c70c2c842749a8029849860e9f6893d6c09a3507042c0e6ad4c6835b3913eebcc31afcf7ff96afd26760c34da9cdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\4A77.exe
Filesize
255KB

MD5
cd7f488588b891094c27999d19388be9

SHA1
8f6d5e96247d0bd8c04842727f08b9fdaf879d06

SHA256
2a9262660a612c10017d661e2cd82a2e1dabef943542e83bc0f72426622a761a

SHA512
b8d90f7b60d90d269239da9b8845d84e546da2135aa3f444e84efd52b347cc96d46440ed2f728489e281ffad1cf220697c6bfa57137c9f3e44632102a408d188

Download Submit
C:\Users\Admin\AppData\Local\Temp\4A77.exe
Filesize
255KB

MD5
cd7f488588b891094c27999d19388be9

SHA1
8f6d5e96247d0bd8c04842727f08b9fdaf879d06

SHA256
2a9262660a612c10017d661e2cd82a2e1dabef943542e83bc0f72426622a761a

SHA512
b8d90f7b60d90d269239da9b8845d84e546da2135aa3f444e84efd52b347cc96d46440ed2f728489e281ffad1cf220697c6bfa57137c9f3e44632102a408d188

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dhfteep.tmp
Filesize
3.3MB

MD5
9ee66bd586450c037b6a14eed557a159

SHA1
6218331454c5204349b259ea260dd2161ce41371

SHA256
d9cf31419401bed1796f49f2daea2f9eea468c3643ab9086ba61d24e3283db0f

SHA512
eabdb81f278abe54088740b4139ca6d5b8cf99c014102128b9c3ebebf51b163d6ba0b06a066de1eeb33199c2a475c0ce585c102b7684ce2d086b493f842ee8a8

Download Submit
memory/680-182-0x0000000000C40000-0x00000000015DC000-memory.dmp

Filesize
9.6MB

Download
memory/680-181-0x00000000030A0000-0x0000000003B5C000-memory.dmp

Filesize
10.7MB

Download
memory/680-180-0x00000000030A0000-0x0000000003B5C000-memory.dmp

Filesize
10.7MB

Download
memory/680-179-0x0000000003CB0000-0x0000000003DF0000-memory.dmp

Filesize
1.2MB

Download
memory/680-178-0x0000000003CB0000-0x0000000003DF0000-memory.dmp

Filesize
1.2MB

Download
memory/680-175-0x0000000000000000-mapping.dmp

Download
memory/680-176-0x0000000000C40000-0x00000000015DC000-memory.dmp

Filesize
9.6MB

Download
memory/680-177-0x00000000030A0000-0x0000000003B5C000-memory.dmp

Filesize
10.7MB

Download
memory/3420-138-0x0000000000400000-0x0000000002C2E000-memory.dmp

Filesize
40.2MB

Download
memory/3420-137-0x0000000000400000-0x0000000002C2E000-memory.dmp

Filesize
40.2MB

Download
memory/3420-135-0x0000000002DE2000-0x0000000002DF7000-memory.dmp

Filesize
84KB

Download
memory/3420-136-0x0000000002D00000-0x0000000002D09000-memory.dmp

Filesize
36KB

Download
memory/3444-156-0x0000000000400000-0x0000000002C2E000-memory.dmp

Filesize
40.2MB

Download
memory/3444-155-0x0000000002C8D000-0x0000000002CA2000-memory.dmp

Filesize
84KB

Download
memory/3444-157-0x0000000002C8D000-0x0000000002CA2000-memory.dmp

Filesize
84KB

Download
memory/4088-165-0x0000000002CD3000-0x0000000002CE8000-memory.dmp

Filesize
84KB

Download
memory/4088-152-0x0000000000400000-0x0000000002C2E000-memory.dmp

Filesize
40.2MB

Download
memory/4088-150-0x0000000002CD3000-0x0000000002CE8000-memory.dmp

Filesize
84KB

Download
memory/4088-151-0x0000000002CB0000-0x0000000002CB9000-memory.dmp

Filesize
36KB

Download
memory/4088-147-0x0000000000000000-mapping.dmp

Download
memory/4460-142-0x0000000000000000-mapping.dmp

Download
memory/4828-160-0x0000000000000000-mapping.dmp

Download
memory/4892-159-0x0000000000400000-0x0000000002D3B000-memory.dmp

Filesize
41.2MB

Download
memory/4892-164-0x00000000056A0000-0x000000000615C000-memory.dmp

Filesize
10.7MB

Download
memory/4892-166-0x00000000056A0000-0x000000000615C000-memory.dmp

Filesize
10.7MB

Download
memory/4892-167-0x0000000006320000-0x0000000006460000-memory.dmp

Filesize
1.2MB

Download
memory/4892-169-0x0000000006320000-0x0000000006460000-memory.dmp

Filesize
1.2MB

Download
memory/4892-170-0x0000000006320000-0x0000000006460000-memory.dmp

Filesize
1.2MB

Download
memory/4892-171-0x0000000006320000-0x0000000006460000-memory.dmp

Filesize
1.2MB

Download
memory/4892-168-0x0000000006320000-0x0000000006460000-memory.dmp

Filesize
1.2MB

Download
memory/4892-172-0x0000000006320000-0x0000000006460000-memory.dmp

Filesize
1.2MB

Download
memory/4892-173-0x0000000006320000-0x0000000006460000-memory.dmp

Filesize
1.2MB

Download
memory/4892-163-0x00000000056A0000-0x000000000615C000-memory.dmp

Filesize
10.7MB

Download
memory/4892-174-0x0000000006320000-0x0000000006460000-memory.dmp

Filesize
1.2MB

Download
memory/4892-161-0x0000000000400000-0x0000000002D3B000-memory.dmp

Filesize
41.2MB

Download
memory/4892-158-0x0000000000400000-0x0000000002D3B000-memory.dmp

Filesize
41.2MB

Download
memory/4892-146-0x0000000000400000-0x0000000002D3B000-memory.dmp

Filesize
41.2MB

Download
memory/4892-145-0x0000000000400000-0x0000000002D3B000-memory.dmp

Filesize
41.2MB

Download
memory/4892-144-0x0000000004B70000-0x0000000004E3C000-memory.dmp

Filesize
2.8MB

Download
memory/4892-143-0x00000000030AA000-0x00000000031CB000-memory.dmp

Filesize
1.1MB

Download
memory/4892-139-0x0000000000000000-mapping.dmp

Download
memory/4892-183-0x00000000056A0000-0x000000000615C000-memory.dmp

Filesize
10.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads