Analysis

  • max time kernel
    158s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2022 08:10

General

  • Target

    ff78e5c3a545e64efe6b467c094fb3232b5289d8ed8779b4f4efb286e1a44bc3.exe

  • Size

    2.6MB

  • MD5

    2d524a5cd462b3bfc756aa769b6f2413

  • SHA1

    42f38de68754d6359dcf9a552a784f65e990410c

  • SHA256

    ff78e5c3a545e64efe6b467c094fb3232b5289d8ed8779b4f4efb286e1a44bc3

  • SHA512

    1eda516758373245e02c91a901f8eadf8df6e61334cce2ec33e13409bf9e7892fce0363251123024f067cd281668a5c57f3d888f521b60d22ed98e3e601867b9

  • SSDEEP

    49152:eFPwnw9iU+HznCx4EuGvQTRK8yRqMOydsI2GQ71NaYaS9t61V8ycHfJb7KrzixOh:eFPgg+Hzn+rvcg8y7ds597OYaRV72xxO

Score
10/10

Malware Config

Extracted

Family

danabot

Attributes
  • embedded_hash

    341D2FD1638BB267A80C7445E1909B57

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff78e5c3a545e64efe6b467c094fb3232b5289d8ed8779b4f4efb286e1a44bc3.exe
    "C:\Users\Admin\AppData\Local\Temp\ff78e5c3a545e64efe6b467c094fb3232b5289d8ed8779b4f4efb286e1a44bc3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Didddpquafu.dll,start
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:648
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14030
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:3176
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 696
      2⤵
      • Program crash
      PID:4012
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3516 -ip 3516
    1⤵
      PID:4808
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2940

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Discovery

      System Information Discovery

      2
      T1082

      Query Registry

      1
      T1012

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Didddpquafu.dll
        Filesize

        2.4MB

        MD5

        e59a86a91654857362a18a434be0bc91

        SHA1

        a3a9efb93032451fc6d22d21041e7ff54c58d346

        SHA256

        2f002517db74aa323c00025ef39c04aadc128d67d4429d61505900c1e399a13c

        SHA512

        fe1596a774579b9b8d1be8881d4de7123b538d567c8c55e1565b3f943679456399877011688df6f4e1cee9f57b0d39f7c60e6bec823db4669e2652306485b3ed

      • C:\Users\Admin\AppData\Local\Temp\Didddpquafu.dll
        Filesize

        2.4MB

        MD5

        e59a86a91654857362a18a434be0bc91

        SHA1

        a3a9efb93032451fc6d22d21041e7ff54c58d346

        SHA256

        2f002517db74aa323c00025ef39c04aadc128d67d4429d61505900c1e399a13c

        SHA512

        fe1596a774579b9b8d1be8881d4de7123b538d567c8c55e1565b3f943679456399877011688df6f4e1cee9f57b0d39f7c60e6bec823db4669e2652306485b3ed

      • C:\Users\Admin\AppData\Local\Temp\Didddpquafu.dll
        Filesize

        2.4MB

        MD5

        e59a86a91654857362a18a434be0bc91

        SHA1

        a3a9efb93032451fc6d22d21041e7ff54c58d346

        SHA256

        2f002517db74aa323c00025ef39c04aadc128d67d4429d61505900c1e399a13c

        SHA512

        fe1596a774579b9b8d1be8881d4de7123b538d567c8c55e1565b3f943679456399877011688df6f4e1cee9f57b0d39f7c60e6bec823db4669e2652306485b3ed

      • memory/648-144-0x0000000004550000-0x0000000004690000-memory.dmp
        Filesize

        1.2MB

      • memory/648-146-0x0000000004550000-0x0000000004690000-memory.dmp
        Filesize

        1.2MB

      • memory/648-139-0x0000000002A40000-0x0000000002CB1000-memory.dmp
        Filesize

        2.4MB

      • memory/648-156-0x0000000003D60000-0x0000000004485000-memory.dmp
        Filesize

        7.1MB

      • memory/648-150-0x0000000004550000-0x0000000004690000-memory.dmp
        Filesize

        1.2MB

      • memory/648-148-0x0000000004550000-0x0000000004690000-memory.dmp
        Filesize

        1.2MB

      • memory/648-141-0x0000000003D60000-0x0000000004485000-memory.dmp
        Filesize

        7.1MB

      • memory/648-142-0x0000000003D60000-0x0000000004485000-memory.dmp
        Filesize

        7.1MB

      • memory/648-143-0x0000000003D60000-0x0000000004485000-memory.dmp
        Filesize

        7.1MB

      • memory/648-149-0x00000000045C9000-0x00000000045CB000-memory.dmp
        Filesize

        8KB

      • memory/648-145-0x0000000004550000-0x0000000004690000-memory.dmp
        Filesize

        1.2MB

      • memory/648-135-0x0000000000000000-mapping.dmp
      • memory/648-147-0x0000000004550000-0x0000000004690000-memory.dmp
        Filesize

        1.2MB

      • memory/3176-151-0x00007FF78FE66890-mapping.dmp
      • memory/3176-152-0x0000019D70130000-0x0000019D70270000-memory.dmp
        Filesize

        1.2MB

      • memory/3176-153-0x0000019D70130000-0x0000019D70270000-memory.dmp
        Filesize

        1.2MB

      • memory/3176-154-0x0000000000450000-0x0000000000669000-memory.dmp
        Filesize

        2.1MB

      • memory/3176-155-0x0000019D6E8F0000-0x0000019D6EB1A000-memory.dmp
        Filesize

        2.2MB

      • memory/3516-132-0x0000000000DF6000-0x0000000001041000-memory.dmp
        Filesize

        2.3MB

      • memory/3516-140-0x0000000000400000-0x0000000000792000-memory.dmp
        Filesize

        3.6MB

      • memory/3516-133-0x00000000027F0000-0x0000000002B75000-memory.dmp
        Filesize

        3.5MB

      • memory/3516-134-0x0000000000400000-0x0000000000792000-memory.dmp
        Filesize

        3.6MB