Analysis

  • max time kernel
    133s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19/12/2022, 08:20

General

  • Target

    9292bc6aec169cc1f3f223470669c6307f1d3e61687544c0a228846c1cf0df97.exe

  • Size

    1.1MB

  • MD5

    d4fe627b0bc66a57bfdb76c531c06ce6

  • SHA1

    1a9ff0a579460a2e90266ebbfbad127514a74e7a

  • SHA256

    9292bc6aec169cc1f3f223470669c6307f1d3e61687544c0a228846c1cf0df97

  • SHA512

    bea169646b86ca0659efe0989856d58098efcc70d8b8953045635ddd7d4293aed656771d8d0a1e5e4e87a4f272b8e6b69f4eeacd7d7f7220d5b6e50535aa2617

  • SSDEEP

    24576:4MsPdMWW1GIdBCSGZtT/EHr0HUqcBfcvGjZzK6r:XngtAHr0HU7cu9zKM

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 3 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 53 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9292bc6aec169cc1f3f223470669c6307f1d3e61687544c0a228846c1cf0df97.exe
    "C:\Users\Admin\AppData\Local\Temp\9292bc6aec169cc1f3f223470669c6307f1d3e61687544c0a228846c1cf0df97.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:3476
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 24002
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:3680
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:4112
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:4944
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
            3⤵
              PID:200
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
              3⤵
                PID:1960
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
                3⤵
                  PID:3952
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
                  3⤵
                    PID:3392
              • C:\Windows\System32\rundll32.exe
                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                1⤵
                  PID:3376
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe -k LocalService
                  1⤵
                  • Loads dropped DLL
                  • Checks processor information in registry
                  PID:4800
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\review_same_reviewers.dll",VjkdbldPeQ==
                    2⤵
                      PID:2912

                  Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\0__Power_Policy.provxml

                          Filesize

                          1KB

                          MD5

                          fdab2b3426d106210e616103cacf57ba

                          SHA1

                          5972f2e5dcecc133ee431ea6fd85271c22e67b3b

                          SHA256

                          e5b49aef39aba5f51a3d2724418b8848721b0e5d7459e5e9a3deec161a3ab4b1

                          SHA512

                          ec116a9370446129ad7f7c4767c213bc0a75c3bca6d1e7a2d4705f167a841b5af8e3edaad1924090d78870fa328ed773d3e45a2f2037b2c917b79dd68aa47c5e

                        • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\116__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml

                          Filesize

                          712B

                          MD5

                          94de53673235e5f020beae2e9cd5f524

                          SHA1

                          3eac9d16162ec495b5e17897a6455c6efb255fd9

                          SHA256

                          f6206b943399614c8c08daa015fd9ba01c8bfd61e47188c573affafdcf5f3525

                          SHA512

                          4d89a2326f4ffabdbe7f28ffad7b7d30dd3f26c234d99efd399c0250456d5395f19dad285dffa5f3a4197af35369af473a090fc5aa1c48c1fbb3e2117353fba8

                        • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MasterDatastore.xml

                          Filesize

                          271B

                          MD5

                          d6650e3886f3c95fb42d4f0762b04173

                          SHA1

                          1da4b8bb6bb45d576616ad843cf6e4c2e9d4784b

                          SHA256

                          9101f028c2288850be393281297500902b297c8b6ecf793292678b04a72709c9

                          SHA512

                          1f82db4bd6ea401bb5610c21ed48848b9b61c55aabb4efada31dc677835b8e4451045006c4067e9cc51267a1c861765b49c3b3ab4c568be1dca0c0109fd8ceaa

                        • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

                          Filesize

                          2.3MB

                          MD5

                          f7e0d6c9f7a4b410025dcb43c9c4e9ea

                          SHA1

                          562bb160a37659628ee22916e34b2d5ac3036985

                          SHA256

                          2de836b400284fba52a8dedf08e34e1f55f6779e16f01a8debef343521d405dd

                          SHA512

                          451c0bd3e3f5a8bfef4169fdf01bee92cf260239945585dbd59e88fb3a0050a88630c67e8760cd164ff2082aa03d9c02624e44efa4e1a55020696df85ff5e00f

                        • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\resource.xml

                          Filesize

                          1KB

                          MD5

                          8a660378169f2615d70683a49d6540c9

                          SHA1

                          4e78f156eb4b8766568071e81b793f05b9ea7658

                          SHA256

                          f288b4ffdb060471a51dcea18c8e104c62cfcd8c37d7a41ee343145b4953cf46

                          SHA512

                          754bc1a9c90e4c4ea6cf1881d26c1afbb049870f41ff71c7c943726a1706f6b0b44a2f32742065f9d5eacc54d21cb54b76f5f17315af04614612f9cc58e46648

                        • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\s640.hash

                          Filesize

                          106B

                          MD5

                          bef40d5a19278ca19b56fbcdde7e26ef

                          SHA1

                          4f01d5b8de038e120c64bd7cc22cf150af1452fb

                          SHA256

                          7f9c7cc5b265e312fc587d98c7c31218b7a46f1efb8c397dcc329354b4e5831d

                          SHA512

                          5a361b1378c7b9f635e72ffdfba4d59acd17341caba480a5271237a37d40d8eb03a6ca7f3c38e73ce87a15b682d434ffa0a7f96dd6355e286d8213a80518c493

                        • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\scan_.ico

                          Filesize

                          59KB

                          MD5

                          a161b3f9fd62c3931fbd79512810cffa

                          SHA1

                          a63f1d8945b983356b66819b3aa5b0bd409995e4

                          SHA256

                          d3ba9eecc5e87b384242385078846cff82051194887ce2d7343bb7b60e7a26d7

                          SHA512

                          f07776d386a39b20e3721b7450248e458ecd6f477197028aa42e2ab6a2731a002170a5415fb02fadac40b1b97acee3b5064ff76606ba2bcc14f7e7b674524299

                        • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

                          Filesize

                          726KB

                          MD5

                          6ea8a6cc5fed6c664df1b3ef7c56b55d

                          SHA1

                          6b244d708706441095ae97294928967ddf28432b

                          SHA256

                          2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

                          SHA512

                          4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

                        • \??\c:\program files (x86)\windowspowershell\modules\review_same_reviewers.dll

                          Filesize

                          726KB

                          MD5

                          cafb18c5a32c85ebe846d736c7497d3c

                          SHA1

                          860101785982c3877e7cfbcebfd2a78fd40e6491

                          SHA256

                          927c9e152fe94e83223e7adc97c754a7ff2bb837e88e5379b7f940ab8926cf85

                          SHA512

                          8c2ae056a5605cc30bca76cd783bd66f75184a00cb261163ae74c247fc79ee454660aa8b22b26db0c39836c582b8b3e7b09b4c68aef4ffe2e1d9495dd555d2be

                        • \Program Files (x86)\WindowsPowerShell\Modules\review_same_reviewers.dll

                          Filesize

                          726KB

                          MD5

                          cafb18c5a32c85ebe846d736c7497d3c

                          SHA1

                          860101785982c3877e7cfbcebfd2a78fd40e6491

                          SHA256

                          927c9e152fe94e83223e7adc97c754a7ff2bb837e88e5379b7f940ab8926cf85

                          SHA512

                          8c2ae056a5605cc30bca76cd783bd66f75184a00cb261163ae74c247fc79ee454660aa8b22b26db0c39836c582b8b3e7b09b4c68aef4ffe2e1d9495dd555d2be

                        • \Program Files (x86)\WindowsPowerShell\Modules\review_same_reviewers.dll

                          Filesize

                          726KB

                          MD5

                          cafb18c5a32c85ebe846d736c7497d3c

                          SHA1

                          860101785982c3877e7cfbcebfd2a78fd40e6491

                          SHA256

                          927c9e152fe94e83223e7adc97c754a7ff2bb837e88e5379b7f940ab8926cf85

                          SHA512

                          8c2ae056a5605cc30bca76cd783bd66f75184a00cb261163ae74c247fc79ee454660aa8b22b26db0c39836c582b8b3e7b09b4c68aef4ffe2e1d9495dd555d2be

                        • \Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

                          Filesize

                          726KB

                          MD5

                          6ea8a6cc5fed6c664df1b3ef7c56b55d

                          SHA1

                          6b244d708706441095ae97294928967ddf28432b

                          SHA256

                          2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

                          SHA512

                          4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

                        • memory/2780-151-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-160-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-137-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-138-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-139-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-140-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-141-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-142-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-143-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-144-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-145-0x0000000002270000-0x000000000234F000-memory.dmp

                          Filesize

                          892KB

                        • memory/2780-146-0x0000000002460000-0x0000000002575000-memory.dmp

                          Filesize

                          1.1MB

                        • memory/2780-148-0x0000000000400000-0x0000000000517000-memory.dmp

                          Filesize

                          1.1MB

                        • memory/2780-147-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-149-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-150-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-134-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-152-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-153-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-154-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-155-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-156-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-158-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-157-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-159-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-136-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-161-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-162-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-163-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-164-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-121-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-122-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-123-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-120-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-168-0x0000000000400000-0x0000000000517000-memory.dmp

                          Filesize

                          1.1MB

                        • memory/2780-133-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-124-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-132-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-131-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-130-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-129-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-127-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-128-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-126-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2780-125-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/2912-528-0x0000000005C80000-0x00000000063A5000-memory.dmp

                          Filesize

                          7.1MB

                        • memory/2912-540-0x0000000005C80000-0x00000000063A5000-memory.dmp

                          Filesize

                          7.1MB

                        • memory/3476-169-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-173-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-187-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-186-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-188-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-189-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-185-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-184-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-265-0x0000000006B80000-0x00000000072A5000-memory.dmp

                          Filesize

                          7.1MB

                        • memory/3476-166-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-167-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-170-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-330-0x0000000006B80000-0x00000000072A5000-memory.dmp

                          Filesize

                          7.1MB

                        • memory/3476-171-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-182-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-181-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-180-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-179-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-172-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-178-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-177-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-176-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-175-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-174-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3476-183-0x0000000077710000-0x000000007789E000-memory.dmp

                          Filesize

                          1.6MB

                        • memory/3680-288-0x00000184922B0000-0x00000184924DA000-memory.dmp

                          Filesize

                          2.2MB

                        • memory/3680-287-0x0000000000E00000-0x0000000001019000-memory.dmp

                          Filesize

                          2.1MB

                        • memory/4800-426-0x0000000004E50000-0x0000000005575000-memory.dmp

                          Filesize

                          7.1MB

                        • memory/4800-577-0x0000000004E50000-0x0000000005575000-memory.dmp

                          Filesize

                          7.1MB