danabot | 9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0

General

Target

9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0.exe
Size

213KB
MD5

e19e872d0ea3c395f5e207bda52da9e8
SHA1

402ab88f125ad2a34b5295d8e33e59e09621f139
SHA256

9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0
SHA512

04074d29322d85c8a70cd0fce4696055212b36c25b31f4a8362593376b4e144cbdc54764f9b2a3b03f8882a35225488acd14f15cc6f59da9a71d6759a940bd35
SSDEEP

3072:nibd0YGML5NShZwR50lci7CQKIW99Snh8/g3xoAduMG3ERWR3LV:ed07MLLSh7l7E6Gg3CnU0VB

Score

10^/10

danabot smokeloader backdoor banker discovery persistence trojan

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes

embedded_hash
46074984462FB8A91EB57ACE680A2020
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3468-133-0x00000000001F0000-0x00000000001F9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

38 396 rundll32.exe
41 396 rundll32.exe
55 396 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

E5C1.exe

pid process

1836 E5C1.exe

flow	pid	process
38	396	rundll32.exe
41	396	rundll32.exe
55	396	rundll32.exe

pid	process
1836	E5C1.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\manifest.\Parameters\ServiceDll = "C:\\Program Files (x86)\\MSBuild\\Microsoft\\manifest..dll"	rundll32.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\manifest.\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService"	rundll32.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

396 rundll32.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 396 set thread context of 2248 396 rundll32.exe rundll32.exe

pid	process
396	rundll32.exe

description	pid	process	target process
PID 396 set thread context of 2248	396	rundll32.exe	rundll32.exe

Drops file in Program Files directory 31 IoCs

Processes:

rundll32.exe

description	ioc	process
File created	C:\Program Files (x86)\MSBuild\Microsoft\turnOnNotificationInAcrobat.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\editpdf.svg	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\A3DUtils.dll	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\sendforcomments.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_sent.gif	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\s_filetype_psd.svg	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\manifest..dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforcomments.svg	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\EPDF_Full.aapp	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\MyriadCAD.otf	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\email_all.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\editpdf.svg	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\export.svg	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\AcroTextExtractor.exe	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_filetype_psd.svg	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\SaveAsRTF.api	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Compare_R_RHP.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\MyriadCAD.otf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\A3DUtils.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\export.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\reviews_sent.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_Full.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\32BitMAPIBroker.exe	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\base_uris.js	rundll32.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Compare_R_RHP.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\base_uris.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOnNotificationInAcrobat.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3400 1836 WerFault.exe E5C1.exe

pid	pid_target	process	target process
3400	1836	WerFault.exe	E5C1.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Modifies registry class 30 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000092555811100054656d7000003a0009000400efbe6b55586c925560112e00000000000000000000000000000000000000000000000000936b3b00540065006d007000000014000000
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pid process

2176

pid	process
2176

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0.exe

pid	process
3468	9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0.exe
3468	9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0.exe
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176
2176

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2176
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0.exe

pid process

3468 9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0.exe

pid	process
2176

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	2176
Token: SeCreatePagefilePrivilege	2176
Token: SeShutdownPrivilege	2176
Token: SeCreatePagefilePrivilege	2176
Token: SeShutdownPrivilege	2176
Token: SeCreatePagefilePrivilege	2176
Token: SeShutdownPrivilege	2176
Token: SeCreatePagefilePrivilege	2176
Token: SeShutdownPrivilege	2176
Token: SeCreatePagefilePrivilege	2176
Token: SeShutdownPrivilege	2176
Token: SeCreatePagefilePrivilege	2176
Token: SeShutdownPrivilege	2176
Token: SeCreatePagefilePrivilege	2176
Token: SeShutdownPrivilege	2176
Token: SeCreatePagefilePrivilege	2176
Token: SeShutdownPrivilege	2176
Token: SeCreatePagefilePrivilege	2176
Token: SeShutdownPrivilege	2176
Token: SeCreatePagefilePrivilege	2176

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

2248 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pid process

2176
2176

pid	process
2248	rundll32.exe

pid	process
2176
2176

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

E5C1.exerundll32.exe

description	pid	process	target process
PID 2176 wrote to memory of 1836	2176		E5C1.exe
PID 2176 wrote to memory of 1836	2176		E5C1.exe
PID 2176 wrote to memory of 1836	2176		E5C1.exe
PID 1836 wrote to memory of 396	1836	E5C1.exe	rundll32.exe
PID 1836 wrote to memory of 396	1836	E5C1.exe	rundll32.exe
PID 1836 wrote to memory of 396	1836	E5C1.exe	rundll32.exe
PID 396 wrote to memory of 2248	396	rundll32.exe	rundll32.exe
PID 396 wrote to memory of 2248	396	rundll32.exe	rundll32.exe
PID 396 wrote to memory of 2248	396	rundll32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0.exe
"C:\Users\Admin\AppData\Local\Temp\9c76302f9096c0f7f9474d495607ef306dc101b9cbbdd652d99c137d88426ac0.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3468

C:\Users\Admin\AppData\Local\Temp\E5C1.exe
C:\Users\Admin\AppData\Local\Temp\E5C1.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll,start
2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:396

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 20209
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 480
2⤵
- Program crash
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1836 -ip 1836
1⤵
PID:5028

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1048

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k LocalService
1⤵
PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\MSBuild\Microsoft\manifest..dll
Filesize
2.4MB

MD5
bf3e8d18f407ce049ad6ba4201b90ff6

SHA1
554c303c9ea5b1ffa92d25759ba287b86b8ce48e

SHA256
8f90584f3565c7ad3a324ccb23c97967ecd609ab68d3b647f1ddc721bad9da2a

SHA512
c417647f4cc3572db2e7cb6b8c34cabcfed5661dfe01c97c88227ffb8a9025afb443450aeb9e62ffda0744445a003bbc76850a0849d874b16bd3b27aba38e7e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\E5C1.exe
Filesize
2.4MB

MD5
0bb2b15ca73128dbc816ea4ed583119c

SHA1
17d05964d9208ca1a27fd007ad5f41752cfa893e

SHA256
295dfd4608b81ee276a04f1c58d806b7f906695e744cfe8234eca6360c555ca8

SHA512
d58afa63c04cb95576e9a7b5ae026dc28526cee7a26c5e829c091356179f4d255503914398dd209c506743ab78f16cb84d862e2f8ae5f43282bfe2a3e7afe375

Download Submit
C:\Users\Admin\AppData\Local\Temp\E5C1.exe
Filesize
2.4MB

MD5
0bb2b15ca73128dbc816ea4ed583119c

SHA1
17d05964d9208ca1a27fd007ad5f41752cfa893e

SHA256
295dfd4608b81ee276a04f1c58d806b7f906695e744cfe8234eca6360c555ca8

SHA512
d58afa63c04cb95576e9a7b5ae026dc28526cee7a26c5e829c091356179f4d255503914398dd209c506743ab78f16cb84d862e2f8ae5f43282bfe2a3e7afe375

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
Filesize
2.4MB

MD5
a83775d257bbcf5abe9ea1b0c66eb2eb

SHA1
cfb1b33b1c8352aac85d866ee7c5bd4aa47b5233

SHA256
0fa1a3c7853e84fd1d3f0ea680400e67bd124672b9495987cca8719347dd8810

SHA512
e5532a0cf4e4ab69fdbe87aacc7ee8ba904d8d7ac6c110d886056095b2692cc1f05c75fd480645eb11fd216558bf01640beccbffc38aaf38a2dd316c7f839247

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
Filesize
2.4MB

MD5
a83775d257bbcf5abe9ea1b0c66eb2eb

SHA1
cfb1b33b1c8352aac85d866ee7c5bd4aa47b5233

SHA256
0fa1a3c7853e84fd1d3f0ea680400e67bd124672b9495987cca8719347dd8810

SHA512
e5532a0cf4e4ab69fdbe87aacc7ee8ba904d8d7ac6c110d886056095b2692cc1f05c75fd480645eb11fd216558bf01640beccbffc38aaf38a2dd316c7f839247

Download Submit
\??\c:\program files (x86)\msbuild\microsoft\manifest..dll
Filesize
2.4MB

MD5
bf3e8d18f407ce049ad6ba4201b90ff6

SHA1
554c303c9ea5b1ffa92d25759ba287b86b8ce48e

SHA256
8f90584f3565c7ad3a324ccb23c97967ecd609ab68d3b647f1ddc721bad9da2a

SHA512
c417647f4cc3572db2e7cb6b8c34cabcfed5661dfe01c97c88227ffb8a9025afb443450aeb9e62ffda0744445a003bbc76850a0849d874b16bd3b27aba38e7e1

Download Submit
memory/396-156-0x0000000004130000-0x0000000004270000-memory.dmp

Filesize
1.2MB

Download
memory/396-151-0x0000000004130000-0x0000000004270000-memory.dmp

Filesize
1.2MB

Download
memory/396-163-0x0000000003940000-0x0000000004065000-memory.dmp

Filesize
7.1MB

Download
memory/396-160-0x00000000041A9000-0x00000000041AB000-memory.dmp

Filesize
8KB

Download
memory/396-142-0x0000000000000000-mapping.dmp

Download
memory/396-155-0x0000000004130000-0x0000000004270000-memory.dmp

Filesize
1.2MB

Download
memory/396-154-0x0000000004130000-0x0000000004270000-memory.dmp

Filesize
1.2MB

Download
memory/396-145-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download
memory/396-153-0x0000000004130000-0x0000000004270000-memory.dmp

Filesize
1.2MB

Download
memory/396-147-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download
memory/396-148-0x0000000003940000-0x0000000004065000-memory.dmp

Filesize
7.1MB

Download
memory/396-149-0x0000000003940000-0x0000000004065000-memory.dmp

Filesize
7.1MB

Download
memory/396-150-0x0000000003940000-0x0000000004065000-memory.dmp

Filesize
7.1MB

Download
memory/396-152-0x0000000004130000-0x0000000004270000-memory.dmp

Filesize
1.2MB

Download
memory/1836-139-0x0000000000AFE000-0x0000000000D49000-memory.dmp

Filesize
2.3MB

Download
memory/1836-146-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/1836-140-0x00000000026F0000-0x0000000002A75000-memory.dmp

Filesize
3.5MB

Download
memory/1836-136-0x0000000000000000-mapping.dmp

Download
memory/1836-141-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/2248-159-0x000002913CD80000-0x000002913CEC0000-memory.dmp

Filesize
1.2MB

Download
memory/2248-157-0x00007FF7D1AC6890-mapping.dmp

Download
memory/2248-158-0x000002913CD80000-0x000002913CEC0000-memory.dmp

Filesize
1.2MB

Download
memory/2248-161-0x0000000000060000-0x0000000000279000-memory.dmp

Filesize
2.1MB

Download
memory/2248-162-0x000002913B3B0000-0x000002913B5DA000-memory.dmp

Filesize
2.2MB

Download
memory/3468-132-0x0000000000762000-0x0000000000772000-memory.dmp

Filesize
64KB

Download
memory/3468-135-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3468-134-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3468-133-0x00000000001F0000-0x00000000001F9000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads