Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2022, 09:44

General

  • Target

    file.exe

  • Size

    307KB

  • MD5

    020a318f5515faf139b30412dde8760c

  • SHA1

    ff709428ba6245657c273b582b214b105fbbe345

  • SHA256

    bee279ffc033646b7df7ada79b8b3012404c2ce37c5944ceb95c064f523d3f55

  • SHA512

    64a61875f151e82ba09cdcb06094da07dbb9386fd547051c1a94de27a3bb4deb75fa31741bc79588aa0c712175ecadbe6abe0fb64cf47a3fa09e327ca7196ea7

  • SSDEEP

    6144:iyG/L3JIs2uzkXJZq9LTEXA0iPvzpQ6rFiaI:iHTJIbMkC9TaAxnzpQ6rF

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:840
  • C:\Users\Admin\AppData\Local\Temp\D41D.exe
    C:\Users\Admin\AppData\Local\Temp\D41D.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:4928
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23973
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 472
      2⤵
      • Program crash
      PID:3520
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 628 -ip 628
    1⤵
      PID:396
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4768
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\SysWOW64\svchost.exe -k LocalService
        1⤵
          PID:4800
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\comments..dll",sE9hUDRLMWE2
            2⤵
              PID:4168

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\WindowsPowerShell\Modules\Comments..dll

                  Filesize

                  726KB

                  MD5

                  76a76b9347d3f23fdbd8726490f7235b

                  SHA1

                  e1d8b0f0404563ac8a8302020e95823a197cd349

                  SHA256

                  b0face3b4546a062046ce33437245831cbdeaa18eda6fbccd37678115d14911b

                  SHA512

                  d402efe10aa38c0dbb93d9da22fc726ff9c6231dee28359d323f9c2460ed7ac8e3968575cf105c76b2dcd357fef2ac47b293e03e9c2d46ac1e541a541ffe5a11

                • C:\Program Files (x86)\WindowsPowerShell\Modules\Comments..dll

                  Filesize

                  726KB

                  MD5

                  76a76b9347d3f23fdbd8726490f7235b

                  SHA1

                  e1d8b0f0404563ac8a8302020e95823a197cd349

                  SHA256

                  b0face3b4546a062046ce33437245831cbdeaa18eda6fbccd37678115d14911b

                  SHA512

                  d402efe10aa38c0dbb93d9da22fc726ff9c6231dee28359d323f9c2460ed7ac8e3968575cf105c76b2dcd357fef2ac47b293e03e9c2d46ac1e541a541ffe5a11

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\C2RManifest.officemui.msi.16.en-us.xml

                  Filesize

                  122KB

                  MD5

                  35acff0f35559eac959647a7501385f7

                  SHA1

                  28e052e01fe4e0eac3eab461385460eff7efe271

                  SHA256

                  2669d714f126be033270a9f2919d6152f45c5bec970dc1ab8da09f41351234c0

                  SHA512

                  f3fa4e7499e15a63d2503355705eb08d15be0a3736145c3b46cc79a4fcf7e00df871f62af769090aff7692b34d93365cf413be7b86b27a9df0ecb8f481898ed2

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.MicrosoftEdge_44.19041.1266.0_neutral__8wekyb3d8bbwe.xml

                  Filesize

                  24KB

                  MD5

                  56cc188f572451b90ca1f71b44ac4e64

                  SHA1

                  790a449a478a6fbfd0fa2cc38d541ee62098746b

                  SHA256

                  df14300ee7cae37c4264ca6b10a60e30f8f94cba7b0e6430576decbf031c4eaa

                  SHA512

                  1b42c9e22cf3b8cb0433716364f8f775368c175ddce94026ae30743c352b73a1c4574603967120d28fdcad1f8cf977104f907c7f8140c41b2064d6658945fd83

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftOffice2016Win32.xml

                  Filesize

                  64KB

                  MD5

                  fb54ecf5bbc8554d4218fce2b5863f04

                  SHA1

                  5a43e92271d69b66f97c12d977c10bc78991f76f

                  SHA256

                  bc964a0306fbeca377d20bafd127425c0700ee293a2c5caf9b28285f1b1d75e5

                  SHA512

                  c13e3d7c8801b9a865952708af0fe4272e2034be0ebc40e94f4bdccd13b3075ef8d2b5ec8af68d51fe11d87ce84183275d031390aa00e6cefd02407a03436a40

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

                  Filesize

                  2.3MB

                  MD5

                  7f12ff88fd264c82701443f58c868634

                  SHA1

                  a0f9eaeebb847b55f84b866c3847bedcb23bc4d2

                  SHA256

                  4b463499543528e3723e20c175ffbf345020d85e77e4d4e3b2f1d4c21d6016f7

                  SHA512

                  9d31f30a9d424660067031ce83a6adee0854e9bf46fa0cefb15419611404fadb6b3f192d92a443a64e55a317c7ae0d3f59efbbf188c511cc608f4fe7c722c654

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

                  Filesize

                  2.3MB

                  MD5

                  7f12ff88fd264c82701443f58c868634

                  SHA1

                  a0f9eaeebb847b55f84b866c3847bedcb23bc4d2

                  SHA256

                  4b463499543528e3723e20c175ffbf345020d85e77e4d4e3b2f1d4c21d6016f7

                  SHA512

                  9d31f30a9d424660067031ce83a6adee0854e9bf46fa0cefb15419611404fadb6b3f192d92a443a64e55a317c7ae0d3f59efbbf188c511cc608f4fe7c722c654

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\print_property.ico

                  Filesize

                  58KB

                  MD5

                  30d7062e069bc0a9b34f4034090c1aae

                  SHA1

                  e5fcedd8e4cc0463c0bc6912b1791f2876e28a61

                  SHA256

                  24e77f244b0743e311b0fc97f06513a0cecf6560e92f9c6f164288a152d32000

                  SHA512

                  85dd6c916d48804a24dbbad0f4b4842453ac31a692905f8f2f34112eaa1bbf062a825d45ed5d800bbc4663a28b0b5003ebd5fa54991cf846f1028e929ea06de6

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\utc.privacy.json

                  Filesize

                  31B

                  MD5

                  4870433b19757ef8721b38acf2baa272

                  SHA1

                  d9def40343d41a6a80e936fc12db58ebb3e3fdb8

                  SHA256

                  cf39cf82fe54738a64f566a0f947ddabf90b7af56a899596fb34dca2a67ddfbc

                  SHA512

                  79c72e2c4d8a8538879f11c09877f78ea363ee28f70da66cae50a3372e600a1939372945dc4542a5ee649c18adb5e7d1129fc97635d48c165737193f8b682550

                • C:\Users\Admin\AppData\Local\Temp\D41D.exe

                  Filesize

                  1.1MB

                  MD5

                  d4fe627b0bc66a57bfdb76c531c06ce6

                  SHA1

                  1a9ff0a579460a2e90266ebbfbad127514a74e7a

                  SHA256

                  9292bc6aec169cc1f3f223470669c6307f1d3e61687544c0a228846c1cf0df97

                  SHA512

                  bea169646b86ca0659efe0989856d58098efcc70d8b8953045635ddd7d4293aed656771d8d0a1e5e4e87a4f272b8e6b69f4eeacd7d7f7220d5b6e50535aa2617

                • C:\Users\Admin\AppData\Local\Temp\D41D.exe

                  Filesize

                  1.1MB

                  MD5

                  d4fe627b0bc66a57bfdb76c531c06ce6

                  SHA1

                  1a9ff0a579460a2e90266ebbfbad127514a74e7a

                  SHA256

                  9292bc6aec169cc1f3f223470669c6307f1d3e61687544c0a228846c1cf0df97

                  SHA512

                  bea169646b86ca0659efe0989856d58098efcc70d8b8953045635ddd7d4293aed656771d8d0a1e5e4e87a4f272b8e6b69f4eeacd7d7f7220d5b6e50535aa2617

                • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

                  Filesize

                  726KB

                  MD5

                  6ea8a6cc5fed6c664df1b3ef7c56b55d

                  SHA1

                  6b244d708706441095ae97294928967ddf28432b

                  SHA256

                  2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

                  SHA512

                  4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

                • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

                  Filesize

                  726KB

                  MD5

                  6ea8a6cc5fed6c664df1b3ef7c56b55d

                  SHA1

                  6b244d708706441095ae97294928967ddf28432b

                  SHA256

                  2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

                  SHA512

                  4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

                • \??\c:\program files (x86)\windowspowershell\modules\comments..dll

                  Filesize

                  726KB

                  MD5

                  76a76b9347d3f23fdbd8726490f7235b

                  SHA1

                  e1d8b0f0404563ac8a8302020e95823a197cd349

                  SHA256

                  b0face3b4546a062046ce33437245831cbdeaa18eda6fbccd37678115d14911b

                  SHA512

                  d402efe10aa38c0dbb93d9da22fc726ff9c6231dee28359d323f9c2460ed7ac8e3968575cf105c76b2dcd357fef2ac47b293e03e9c2d46ac1e541a541ffe5a11

                • memory/628-142-0x000000000214D000-0x0000000002223000-memory.dmp

                  Filesize

                  856KB

                • memory/628-143-0x0000000002240000-0x0000000002355000-memory.dmp

                  Filesize

                  1.1MB

                • memory/628-144-0x0000000000400000-0x0000000000517000-memory.dmp

                  Filesize

                  1.1MB

                • memory/840-132-0x00000000006F9000-0x000000000070F000-memory.dmp

                  Filesize

                  88KB

                • memory/840-135-0x0000000000400000-0x0000000000452000-memory.dmp

                  Filesize

                  328KB

                • memory/840-134-0x0000000000400000-0x0000000000452000-memory.dmp

                  Filesize

                  328KB

                • memory/840-133-0x0000000002190000-0x0000000002199000-memory.dmp

                  Filesize

                  36KB

                • memory/1300-166-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-149-0x0000000008130000-0x0000000008140000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-155-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-157-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-159-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-158-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-160-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-161-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-162-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-163-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-164-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-165-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-154-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-167-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-145-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-170-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-169-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-171-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-146-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-147-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-148-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-151-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-150-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-156-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-152-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-153-0x0000000008110000-0x0000000008120000-memory.dmp

                  Filesize

                  64KB

                • memory/1608-181-0x000001770B5E0000-0x000001770B720000-memory.dmp

                  Filesize

                  1.2MB

                • memory/1608-183-0x0000000000820000-0x0000000000A39000-memory.dmp

                  Filesize

                  2.1MB

                • memory/1608-184-0x0000017709C10000-0x0000017709E3A000-memory.dmp

                  Filesize

                  2.2MB

                • memory/1608-180-0x000001770B5E0000-0x000001770B720000-memory.dmp

                  Filesize

                  1.2MB

                • memory/4168-200-0x00000000046D0000-0x0000000004DF5000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4168-199-0x00000000046D0000-0x0000000004DF5000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4800-195-0x00000000035E0000-0x0000000003D05000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4800-189-0x00000000035E0000-0x0000000003D05000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4928-185-0x0000000004A50000-0x0000000005175000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4928-175-0x0000000005330000-0x0000000005470000-memory.dmp

                  Filesize

                  1.2MB

                • memory/4928-174-0x0000000005330000-0x0000000005470000-memory.dmp

                  Filesize

                  1.2MB

                • memory/4928-173-0x0000000005330000-0x0000000005470000-memory.dmp

                  Filesize

                  1.2MB

                • memory/4928-172-0x0000000004A50000-0x0000000005175000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4928-176-0x0000000005330000-0x0000000005470000-memory.dmp

                  Filesize

                  1.2MB

                • memory/4928-177-0x0000000005330000-0x0000000005470000-memory.dmp

                  Filesize

                  1.2MB

                • memory/4928-168-0x0000000004A50000-0x0000000005175000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4928-178-0x0000000005330000-0x0000000005470000-memory.dmp

                  Filesize

                  1.2MB

                • memory/4928-182-0x00000000053A9000-0x00000000053AB000-memory.dmp

                  Filesize

                  8KB