Analysis

  • max time kernel
    126s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    19/12/2022, 09:13

General

  • Target

    52939ddac663150e902b58fdbb2d7b75.exe

  • Size

    1.1MB

  • MD5

    52939ddac663150e902b58fdbb2d7b75

  • SHA1

    a311ef6a1728ec247963a8b276da6f94d0d0a50c

  • SHA256

    73c4486426a8ae3962e83259140d771c80532da079c3da94965039f9d9b8b11a

  • SHA512

    6f6ee5ef9700fa2fbd332ad5b8a749614a465feb9c0c8d0eb7115296c414694f4401535da73d6a413eb62c7c8e9be7bf412b9ecf27c892f5dbc0b1fd62264789

  • SSDEEP

    24576:RnpfiR2so90SCTanbH9v6ffSfkN9fs/FZyZrqkd5VzK6r:DiR2so06Riz3fs4td5VzKM

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 42 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe
    "C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23998
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1524
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:320
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k LocalService
      1⤵
        PID:1220
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windows media player\en-us\defaultid.dll",DAwAVg==
          2⤵
            PID:1128

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\ENVELOPR.DLL.trx_dll

                Filesize

                14KB

                MD5

                10fa6ecb335d75b17d2c3ac4f3cbaabb

                SHA1

                0f549eed3c20f7178f2b6f12cb8f3c0dcf022f94

                SHA256

                1dd89f6d6d5159abd258bf7c0126382986781bee81ad7f7da15e50f2db8e45b8

                SHA512

                c55f5986fb3ba8d2828d0428a8599cfc1e2b1db7263ffc4bedcc016a3ba47539534685b3dfa0edaff5a8e90a7272cac113cedb3ae672cb43a8a6c42040c1ac01

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MAPIR.DLL.trx_dll

                Filesize

                295KB

                MD5

                6160f8c93afc05e003587e6ca882fe45

                SHA1

                0254cbfac12f7d90f2ef4f6310420653c63d7e42

                SHA256

                229e4cbf919ed25ea98a528867d5869352d9e06cda2fdc295976be6b6987445e

                SHA512

                15ddd1efc78f28d8072d8eb33e8fb74500978323e8730aef035d6847748c4f70b6c156cec24d2ff40a880eb9b49248c3b04388bc74485366b923bf710b71b56b

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MSS.chk

                Filesize

                8KB

                MD5

                f7a65946e752c54fc81b2b2d29e0c196

                SHA1

                fa3922af40e1d13a7f236dbad42f40248f610c55

                SHA256

                c6b709ba353d8a828ae7a35cac66b3149e3a8dbc5ad068b64e1661cd0eaddbbd

                SHA512

                469d33a99a86b4a8e8d9c5c2294d33a0793aada11f845eaa314cf96dfc0e87bc2faed3ce97f6b6d3a06ab4a40095b834d023fbc2e6e164db7931a4f845d8bd5d

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

                Filesize

                2.3MB

                MD5

                54ff3900b621e68b4c846280fdced6d5

                SHA1

                537a7c4a624bb02549e5924fcd8d29550f83e2c2

                SHA256

                872488e53ad21946db15b272d9f750d2bc621a1ea71825c0a31848a0d7b8ba6e

                SHA512

                845021452f3c4fac99e57b0d1cab6d824bc804956a8c707517ddf0fad6c4e9683eb0f40977f255dcf243822c18320300544757b2ce97f7ecb14d82925c3a52ea

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

                Filesize

                2.3MB

                MD5

                b1f1b4567224861ddf5d35ea76221834

                SHA1

                ff62e6c22b603db53e617187c3c6fbee81f6e90a

                SHA256

                84e15304b2d4220243f898d30b51638a25c7bbc7ef6244ae5c4fea8e64d8b688

                SHA512

                25cac9eb9507fc9ba1c1e08aeec4b5a4d0ce4e7c7bc6fc464f7852c108cdd39cf628140eef78ae697adc56e150e8ab33600d4af03f591866caa245c9ca850bbc

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\ringtones.ico

                Filesize

                50KB

                MD5

                8b30e7cbd25f178baac418e9b507b61e

                SHA1

                73c93d967571bb88b1bdf33477e7a5f758fc18e9

                SHA256

                0afa2eb896ffe20c5244dd191be791231c8b5b71eff200e75a3150a8e3296f30

                SHA512

                6b0ff7ff67cbb4c8611696273ee16fc5d57b53ea7869e0c97686583d7875faa65f04d7678017628a11420000f8bb869f6dca5fcbefb53b1824443fa73544944d

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\usertile28.bmp

                Filesize

                48KB

                MD5

                48f8ed9f48d19265562803b0ee219a91

                SHA1

                4984fd3b8e278e92022f257ea46cb0301c72797f

                SHA256

                a341b43e0a07fcb987aac58646c6105c52106616f6fae3948865be5023cffddc

                SHA512

                9d88d507c3e88cecf2e11f2541b4e4dca2fc429b92c86b910ba1d15ad8ac3af307c3f4951429e08838e764a7819538877fa7c29ff8704cc6cab23757ec41e0e1

              • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

                Filesize

                726KB

                MD5

                6ea8a6cc5fed6c664df1b3ef7c56b55d

                SHA1

                6b244d708706441095ae97294928967ddf28432b

                SHA256

                2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

                SHA512

                4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

              • \??\c:\program files (x86)\windows media player\en-us\defaultid.dll

                Filesize

                726KB

                MD5

                422c43b3002290e39b743e5e2f58038c

                SHA1

                6c19e2c7162d44dc6d10d925917b39525a74fb58

                SHA256

                722a93ad29bea7383b6912da551a8995642c8636512b37e31d322a7afca81c96

                SHA512

                d1658ce7b013579228b01bbee4febd605366db6341cb5bfc8c6bb2c1d72cb0fb9be32c5d1f6f86915066609b63974ca771c737ea7c5ebf0b2509b7e417d394db

              • \Program Files (x86)\Windows Media Player\en-US\DefaultID.dll

                Filesize

                726KB

                MD5

                422c43b3002290e39b743e5e2f58038c

                SHA1

                6c19e2c7162d44dc6d10d925917b39525a74fb58

                SHA256

                722a93ad29bea7383b6912da551a8995642c8636512b37e31d322a7afca81c96

                SHA512

                d1658ce7b013579228b01bbee4febd605366db6341cb5bfc8c6bb2c1d72cb0fb9be32c5d1f6f86915066609b63974ca771c737ea7c5ebf0b2509b7e417d394db

              • \Program Files (x86)\Windows Media Player\en-US\DefaultID.dll

                Filesize

                726KB

                MD5

                422c43b3002290e39b743e5e2f58038c

                SHA1

                6c19e2c7162d44dc6d10d925917b39525a74fb58

                SHA256

                722a93ad29bea7383b6912da551a8995642c8636512b37e31d322a7afca81c96

                SHA512

                d1658ce7b013579228b01bbee4febd605366db6341cb5bfc8c6bb2c1d72cb0fb9be32c5d1f6f86915066609b63974ca771c737ea7c5ebf0b2509b7e417d394db

              • \Program Files (x86)\Windows Media Player\en-US\DefaultID.dll

                Filesize

                726KB

                MD5

                422c43b3002290e39b743e5e2f58038c

                SHA1

                6c19e2c7162d44dc6d10d925917b39525a74fb58

                SHA256

                722a93ad29bea7383b6912da551a8995642c8636512b37e31d322a7afca81c96

                SHA512

                d1658ce7b013579228b01bbee4febd605366db6341cb5bfc8c6bb2c1d72cb0fb9be32c5d1f6f86915066609b63974ca771c737ea7c5ebf0b2509b7e417d394db

              • \Program Files (x86)\Windows Media Player\en-US\DefaultID.dll

                Filesize

                726KB

                MD5

                422c43b3002290e39b743e5e2f58038c

                SHA1

                6c19e2c7162d44dc6d10d925917b39525a74fb58

                SHA256

                722a93ad29bea7383b6912da551a8995642c8636512b37e31d322a7afca81c96

                SHA512

                d1658ce7b013579228b01bbee4febd605366db6341cb5bfc8c6bb2c1d72cb0fb9be32c5d1f6f86915066609b63974ca771c737ea7c5ebf0b2509b7e417d394db

              • \Program Files (x86)\Windows Media Player\en-US\DefaultID.dll

                Filesize

                726KB

                MD5

                422c43b3002290e39b743e5e2f58038c

                SHA1

                6c19e2c7162d44dc6d10d925917b39525a74fb58

                SHA256

                722a93ad29bea7383b6912da551a8995642c8636512b37e31d322a7afca81c96

                SHA512

                d1658ce7b013579228b01bbee4febd605366db6341cb5bfc8c6bb2c1d72cb0fb9be32c5d1f6f86915066609b63974ca771c737ea7c5ebf0b2509b7e417d394db

              • \Program Files\Mozilla Firefox\firefox.exe

                Filesize

                562KB

                MD5

                d388df6ed5ccbf1acdeda5af2d18cb0b

                SHA1

                124d3c2ba93644ac6c2d7253de242b46be836692

                SHA256

                8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

                SHA512

                f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

              • \Program Files\Mozilla Firefox\firefox.exe

                Filesize

                562KB

                MD5

                d388df6ed5ccbf1acdeda5af2d18cb0b

                SHA1

                124d3c2ba93644ac6c2d7253de242b46be836692

                SHA256

                8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

                SHA512

                f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

              • \Program Files\Mozilla Firefox\firefox.exe

                Filesize

                562KB

                MD5

                d388df6ed5ccbf1acdeda5af2d18cb0b

                SHA1

                124d3c2ba93644ac6c2d7253de242b46be836692

                SHA256

                8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

                SHA512

                f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

              • \Program Files\Mozilla Firefox\firefox.exe

                Filesize

                562KB

                MD5

                d388df6ed5ccbf1acdeda5af2d18cb0b

                SHA1

                124d3c2ba93644ac6c2d7253de242b46be836692

                SHA256

                8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

                SHA512

                f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

              • \Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

                Filesize

                726KB

                MD5

                6ea8a6cc5fed6c664df1b3ef7c56b55d

                SHA1

                6b244d708706441095ae97294928967ddf28432b

                SHA256

                2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

                SHA512

                4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

              • memory/912-55-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

                Filesize

                8KB

              • memory/912-54-0x0000000001E00000-0x0000000001ED6000-memory.dmp

                Filesize

                856KB

              • memory/912-57-0x0000000001E00000-0x0000000001ED6000-memory.dmp

                Filesize

                856KB

              • memory/912-58-0x0000000001F30000-0x0000000002045000-memory.dmp

                Filesize

                1.1MB

              • memory/912-60-0x0000000000400000-0x0000000000517000-memory.dmp

                Filesize

                1.1MB

              • memory/1128-102-0x0000000003910000-0x0000000004035000-memory.dmp

                Filesize

                7.1MB

              • memory/1128-104-0x0000000003910000-0x0000000004035000-memory.dmp

                Filesize

                7.1MB

              • memory/1128-105-0x0000000003910000-0x0000000004035000-memory.dmp

                Filesize

                7.1MB

              • memory/1128-113-0x0000000003910000-0x0000000004035000-memory.dmp

                Filesize

                7.1MB

              • memory/1220-95-0x00000000039B0000-0x00000000040D5000-memory.dmp

                Filesize

                7.1MB

              • memory/1220-86-0x00000000039B0000-0x00000000040D5000-memory.dmp

                Filesize

                7.1MB

              • memory/1220-112-0x00000000039B0000-0x00000000040D5000-memory.dmp

                Filesize

                7.1MB

              • memory/1220-88-0x00000000039B0000-0x00000000040D5000-memory.dmp

                Filesize

                7.1MB

              • memory/1524-77-0x0000000002140000-0x0000000002280000-memory.dmp

                Filesize

                1.2MB

              • memory/1524-70-0x0000000000280000-0x0000000000499000-memory.dmp

                Filesize

                2.1MB

              • memory/1524-76-0x0000000002140000-0x0000000002280000-memory.dmp

                Filesize

                1.2MB

              • memory/1524-78-0x000007FEFC191000-0x000007FEFC193000-memory.dmp

                Filesize

                8KB

              • memory/1524-80-0x0000000001F10000-0x000000000213A000-memory.dmp

                Filesize

                2.2MB

              • memory/1524-79-0x0000000000280000-0x0000000000499000-memory.dmp

                Filesize

                2.1MB

              • memory/1708-81-0x00000000042F0000-0x0000000004A15000-memory.dmp

                Filesize

                7.1MB

              • memory/1708-67-0x0000000004A20000-0x0000000004B60000-memory.dmp

                Filesize

                1.2MB

              • memory/1708-65-0x00000000042F0000-0x0000000004A15000-memory.dmp

                Filesize

                7.1MB

              • memory/1708-74-0x0000000004A20000-0x0000000004B60000-memory.dmp

                Filesize

                1.2MB

              • memory/1708-106-0x0000000006130000-0x0000000006288000-memory.dmp

                Filesize

                1.3MB

              • memory/1708-66-0x00000000042F0000-0x0000000004A15000-memory.dmp

                Filesize

                7.1MB

              • memory/1708-73-0x0000000004A20000-0x0000000004B60000-memory.dmp

                Filesize

                1.2MB

              • memory/1708-72-0x0000000004C00000-0x0000000004D40000-memory.dmp

                Filesize

                1.2MB

              • memory/1708-69-0x0000000004C00000-0x0000000004D40000-memory.dmp

                Filesize

                1.2MB

              • memory/1708-63-0x00000000042F0000-0x0000000004A15000-memory.dmp

                Filesize

                7.1MB

              • memory/1708-68-0x0000000004A20000-0x0000000004B60000-memory.dmp

                Filesize

                1.2MB