Analysis
-
max time kernel
125s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
19/12/2022, 10:04
General
-
Target
d4fe627b0bc66a57bfdb76c531c06ce6.exe
-
Size
1.1MB
-
MD5
d4fe627b0bc66a57bfdb76c531c06ce6
-
SHA1
1a9ff0a579460a2e90266ebbfbad127514a74e7a
-
SHA256
9292bc6aec169cc1f3f223470669c6307f1d3e61687544c0a228846c1cf0df97
-
SHA512
bea169646b86ca0659efe0989856d58098efcc70d8b8953045635ddd7d4293aed656771d8d0a1e5e4e87a4f272b8e6b69f4eeacd7d7f7220d5b6e50535aa2617
-
SSDEEP
24576:4MsPdMWW1GIdBCSGZtT/EHr0HUqcBfcvGjZzK6r:XngtAHr0HU7cu9zKM
Malware Config
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Blocklisted process makes network request 3 IoCs
-
Sets DLL path for service in the registry 2 TTPs 2 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe"C:\Users\Admin\AppData\Local\Temp\d4fe627b0bc66a57bfdb76c531c06ce6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 239863⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 5562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 904 -ip 9041⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\defaultid.dll",i1Y1bmlucQ==2⤵
- Loads dropped DLL
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
726KB
MD5a53099ba5b7e20ac3328fd8c3ca5740b
SHA118772dd1c153b4deb0b507fd847196671ad559ec
SHA2566c1be76ddb00d5f4e8cf63b6383f9dbd462de13c83ff71038bc2962f0efb2187
SHA512b7ee8f7f37aed8ccb8ee0558603d9c785311cdd4da10ea3c83468b573e1eae1d268f9640bcf2bf373081f854d21272044294c3fc278ef4bd5401a0e7a2974a02
-
Filesize
726KB
MD5a53099ba5b7e20ac3328fd8c3ca5740b
SHA118772dd1c153b4deb0b507fd847196671ad559ec
SHA2566c1be76ddb00d5f4e8cf63b6383f9dbd462de13c83ff71038bc2962f0efb2187
SHA512b7ee8f7f37aed8ccb8ee0558603d9c785311cdd4da10ea3c83468b573e1eae1d268f9640bcf2bf373081f854d21272044294c3fc278ef4bd5401a0e7a2974a02
-
Filesize
2KB
MD5e3a68bbd204d36868c6f5570e4576675
SHA1bc5c44144e8e962c62f7febabdb3d0ba20a8162a
SHA25611031974100f363daebe2d5c9e4bf67418d662c73e0341eb71e10b91a33280ac
SHA5127c435d9f0e05469979ac3ce3153ad96ac1b01c9946b3df7230b384cc3ed1a2766dfbad0eb00fa1f2105d0fc0e5a87cbc1eb2c6c700c1041ebe4488a6d16c2f02
-
Filesize
2.3MB
MD5517d550cbf26880577c87c1950812112
SHA1eacff1ea97346804ca51499087f4bdab46c1347f
SHA256b0fdac711f25c1cbb3ddeebbecc0a0223c8c64330602cb0a3d18f50dad6d1102
SHA512d304425ab6689cdbbd96f74c3fb79d968ca0d7476ca9e4d5d60f821fc08d1a29bf11a8e5ffa818e08115afa42f1f6e80a0bee7be887331b08a85d7de0172fe78
-
Filesize
1KB
MD552cf638286d2e53bf8536fb9f4d8014d
SHA1da04999d41cd61d6f6bf0dd87d515dcc85d33e29
SHA256c6aea09422e8d810106006e4abe46a68bc918fc2b02ad135c90f68cd648e3b4a
SHA5122398c927e9818ff3bf663463fb12120b4de3fdd9da2da241edefce2f2e5633f94274d66f1299acc13288bf9a7aca5ca40d91528807968227142e7842867012ed
-
Filesize
438KB
MD5a3c50402ad84ef273e1cbeb541d73389
SHA1f5821ac76fff71ce7d447da98b5689278032511b
SHA256d1cc394435822035a1467be9ad69281de6ecb1b1c83750cb7ccd6202d4c96971
SHA5129518c804b317917243eb3d017a4ba9aed4cd4cbf86477646c33a83777f7cd6d30bacd576cc51069432a5e14f5888e64d9803d9709c10ba25c34bb4234305a53b
-
Filesize
726KB
MD56ea8a6cc5fed6c664df1b3ef7c56b55d
SHA16b244d708706441095ae97294928967ddf28432b
SHA2562c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA5124a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741
-
Filesize
726KB
MD56ea8a6cc5fed6c664df1b3ef7c56b55d
SHA16b244d708706441095ae97294928967ddf28432b
SHA2562c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA5124a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741
-
Filesize
726KB
MD5a53099ba5b7e20ac3328fd8c3ca5740b
SHA118772dd1c153b4deb0b507fd847196671ad559ec
SHA2566c1be76ddb00d5f4e8cf63b6383f9dbd462de13c83ff71038bc2962f0efb2187
SHA512b7ee8f7f37aed8ccb8ee0558603d9c785311cdd4da10ea3c83468b573e1eae1d268f9640bcf2bf373081f854d21272044294c3fc278ef4bd5401a0e7a2974a02
-
Filesize
856KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
1.2MB
-
Filesize
7.1MB
-
Filesize
8KB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
7.1MB
-
Filesize
7.1MB
-
Filesize
7.1MB