Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2022, 10:50

General

  • Target

    82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe

  • Size

    311KB

  • MD5

    4d10dd0618309f40ecd7ec4a1363b4b3

  • SHA1

    6e06c238c064950fed2be8d81e582aad21b3e6d8

  • SHA256

    82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c

  • SHA512

    dde5f5248f2200e18bcb751e74a970b0822449dcc578ef4b4988521a35edac4bca059c2fd5ea4e456381e1a73daae108626e1942f000dcf7d92056a23ebd1b2d

  • SSDEEP

    6144:zs7LQk583d2N9COM0QkOmuF9H4rWlRjO1n:z48k583d2rm0QkOErW9u

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 17 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe
    "C:\Users\Admin\AppData\Local\Temp\82995b3b6525ad11ac24198aa0e7adcb445997351d07c60bbdfac5a26ac7107c.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4620
  • C:\Users\Admin\AppData\Local\Temp\FD7F.exe
    C:\Users\Admin\AppData\Local\Temp\FD7F.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3224
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:3180
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23979
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:4472
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 532
      2⤵
      • Program crash
      PID:4872
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3224 -ip 3224
    1⤵
      PID:204
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3852

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\FD7F.exe

              Filesize

              1.1MB

              MD5

              bf8c7929bc3f4fad1da578dd2b73cc0d

              SHA1

              716a6662f38f3ebb7b2081cf620fc2bf58b4d21e

              SHA256

              aa123ff84c9fc24ff4fd58d0b5796b6b176976774b877efd9ec1c8263e87b08f

              SHA512

              afbc94473c1518114649de98a7fedfb24f842beb98a6129611850c93190467bc117552022b9ad678cb4138995c1c0ce0cfdb27010b6825c9b4bc1847d920e9ab

            • C:\Users\Admin\AppData\Local\Temp\FD7F.exe

              Filesize

              1.1MB

              MD5

              bf8c7929bc3f4fad1da578dd2b73cc0d

              SHA1

              716a6662f38f3ebb7b2081cf620fc2bf58b4d21e

              SHA256

              aa123ff84c9fc24ff4fd58d0b5796b6b176976774b877efd9ec1c8263e87b08f

              SHA512

              afbc94473c1518114649de98a7fedfb24f842beb98a6129611850c93190467bc117552022b9ad678cb4138995c1c0ce0cfdb27010b6825c9b4bc1847d920e9ab

            • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

              Filesize

              726KB

              MD5

              6ea8a6cc5fed6c664df1b3ef7c56b55d

              SHA1

              6b244d708706441095ae97294928967ddf28432b

              SHA256

              2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

              SHA512

              4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

            • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

              Filesize

              726KB

              MD5

              6ea8a6cc5fed6c664df1b3ef7c56b55d

              SHA1

              6b244d708706441095ae97294928967ddf28432b

              SHA256

              2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

              SHA512

              4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

            • memory/3180-146-0x0000000004900000-0x0000000005025000-memory.dmp

              Filesize

              7.1MB

            • memory/3180-152-0x00000000050F0000-0x0000000005230000-memory.dmp

              Filesize

              1.2MB

            • memory/3180-159-0x0000000004900000-0x0000000005025000-memory.dmp

              Filesize

              7.1MB

            • memory/3180-156-0x0000000005169000-0x000000000516B000-memory.dmp

              Filesize

              8KB

            • memory/3180-151-0x00000000050F0000-0x0000000005230000-memory.dmp

              Filesize

              1.2MB

            • memory/3180-150-0x00000000050F0000-0x0000000005230000-memory.dmp

              Filesize

              1.2MB

            • memory/3180-149-0x00000000050F0000-0x0000000005230000-memory.dmp

              Filesize

              1.2MB

            • memory/3180-148-0x00000000050F0000-0x0000000005230000-memory.dmp

              Filesize

              1.2MB

            • memory/3180-145-0x0000000004900000-0x0000000005025000-memory.dmp

              Filesize

              7.1MB

            • memory/3180-147-0x00000000050F0000-0x0000000005230000-memory.dmp

              Filesize

              1.2MB

            • memory/3224-144-0x0000000000400000-0x0000000000517000-memory.dmp

              Filesize

              1.1MB

            • memory/3224-143-0x0000000002230000-0x0000000002345000-memory.dmp

              Filesize

              1.1MB

            • memory/3224-142-0x000000000073F000-0x0000000000815000-memory.dmp

              Filesize

              856KB

            • memory/4472-154-0x000001D75A4B0000-0x000001D75A5F0000-memory.dmp

              Filesize

              1.2MB

            • memory/4472-155-0x000001D75A4B0000-0x000001D75A5F0000-memory.dmp

              Filesize

              1.2MB

            • memory/4472-157-0x0000000000830000-0x0000000000A49000-memory.dmp

              Filesize

              2.1MB

            • memory/4472-158-0x000001D758AC0000-0x000001D758CEA000-memory.dmp

              Filesize

              2.2MB

            • memory/4620-133-0x00000000004D0000-0x00000000004D9000-memory.dmp

              Filesize

              36KB

            • memory/4620-132-0x0000000000718000-0x000000000072D000-memory.dmp

              Filesize

              84KB

            • memory/4620-134-0x0000000000400000-0x0000000000453000-memory.dmp

              Filesize

              332KB

            • memory/4620-135-0x0000000000400000-0x0000000000453000-memory.dmp

              Filesize

              332KB