Analysis

  • max time kernel
    130s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/12/2022, 10:54

General

  • Target

    bf8c7929bc3f4fad1da578dd2b73cc0d.exe

  • Size

    1.1MB

  • MD5

    bf8c7929bc3f4fad1da578dd2b73cc0d

  • SHA1

    716a6662f38f3ebb7b2081cf620fc2bf58b4d21e

  • SHA256

    aa123ff84c9fc24ff4fd58d0b5796b6b176976774b877efd9ec1c8263e87b08f

  • SHA512

    afbc94473c1518114649de98a7fedfb24f842beb98a6129611850c93190467bc117552022b9ad678cb4138995c1c0ce0cfdb27010b6825c9b4bc1847d920e9ab

  • SSDEEP

    24576:6TEz/u9UBBbf5Sk58avkQEEznMQZspzW5dgZhifsS5iW9:6i/uAxf3irwbwmdE7W9

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 3 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf8c7929bc3f4fad1da578dd2b73cc0d.exe
    "C:\Users\Admin\AppData\Local\Temp\bf8c7929bc3f4fad1da578dd2b73cc0d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1072
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23979
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1992
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k LocalService
    1⤵
    • Loads dropped DLL
    PID:1424
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windows media player\en-us\setup.dll",Ew0GTA==
      2⤵
        PID:1164

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Help_MKWD_AssetId.H1W

            Filesize

            229KB

            MD5

            c0ff478794c0e0e95c04332036782234

            SHA1

            05187b9381ac1df0ae1ab4a8746f3a4d8ed8f06a

            SHA256

            a206d8c382ef5fc79f1cc6e542d4cb8cb0f81d494d3b69a21cca5e203d342ceb

            SHA512

            f9e18b2cbe45eb31c9a13253dbd730791ec35c823a227bb5067cba45c19e205e65238d97ce1683536271bf7e320744b88b33ff8134c9cd832535e43cc845f36c

          • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\ONINTL.DLL.trx_dll

            Filesize

            30KB

            MD5

            1fb695309ab96119794ebf365c78bd17

            SHA1

            f49f3f1f8ae2ecd33891ec2a186b9ff1d2d335d3

            SHA256

            7e0893d720e500c139f8cf09dc40c7ef336651954378867b382af32ee0960a3e

            SHA512

            301b579a135e97a95882d53128f4ac66cd039bf57d55f6e41c2421ed9c03820eb05a5a3717b6d553207c028a883900fa46851f7de65ae1fbb39aa949f3c33adf

          • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\PUB6INTL.DLL.trx_dll

            Filesize

            105KB

            MD5

            353eade55c876d2a702479ae98081e2c

            SHA1

            2c9f4d58599c1289346f86a9a7df7d41b4deb61a

            SHA256

            c1312960877c626a07f1df8de16796c14a4399a8a0c97499d1f8978164769e4e

            SHA512

            36185b3645797322084970b0359c6120a41b06dc3bcd5ad9974188b8cbbde4f59e22a928d3f5c946819237b5f2b6fca8677b03a4b005d0ddcfa381c57ce3bb22

          • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Ringtone 06.wma

            Filesize

            92KB

            MD5

            39cbaeceb3ba026de6ec8befece06bfe

            SHA1

            1d12b18db90554a9aad06b7da9c010fe1761ce4a

            SHA256

            a087efb43da9d3ea0c93d976ec790c5faf4a2cd6de70af89f837b185b260eba3

            SHA512

            849d64d97127c28b79f05d4f675f296901965a08884b46d2d2ba1341e93d9c8f01fa9b8bef06fa44b62142fa2a1a6c93b02566294f635edb9dce7d8645942571

          • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

            Filesize

            2.3MB

            MD5

            869690458a216453e8e0f5910159799d

            SHA1

            14091af8fdafe57ec3cf0d5d81c0efdb6865c00e

            SHA256

            0ca76cf72c870d595aff7768b547a6ea286753cc1316247fb1ceb3a8df629200

            SHA512

            3346eb6d71b31644517a7308d26db7ed877f23d0935b4d0f2d0bcf523e4abe338bc1b2a646e23f15e4417a1914a877d473adfaa5fe902057f48bc7b14800e8a1

          • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

            Filesize

            2.3MB

            MD5

            3fa23a5b3f10859d6230631e09bc56e8

            SHA1

            c2c0226a2228311235212d4213b1d62df0122166

            SHA256

            76a3ee0605b98817ff15952ab249bd6f9239a5ba71b785c8d57cba815221d1a1

            SHA512

            0faf762cdb08670aa39fc9206f9fd39c364099321564d3ee3a3b73ca348ad6614cca41c278546fb2ab2f0a5afa48c5e424efbb4cce46aa024a83aa279c863281

          • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\folder.ico

            Filesize

            52KB

            MD5

            bbf9dbdc079c0cd95f78d728aa3912d4

            SHA1

            051f76cc8c6520768bac9559bb329abeebd70d7c

            SHA256

            bef53904908769ceeb60f8e0976c3194e73534f00f4afb65497c2091121b98b2

            SHA512

            af110c52c983f1cf55b3db7d375e03c8c9308e3cf9ee1c154c2b25cb3f8299f0c0ba87b47445f09f98659eb536184c245887a341733c11af713e9ecc15288b5d

          • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\usertile16.bmp

            Filesize

            48KB

            MD5

            d342c2b5f3d16dc992db22cb737ad617

            SHA1

            615a98744fb22809454b706174597a4d6b6d128b

            SHA256

            0618d6fc5a05288bb126eb258fccfe7697e194022a57206671a172a39bc5e486

            SHA512

            4f773f0cb331d46e54f89db7af96be8cd72689cd85d6698d9737052ca088c30e9bc4064cefc277ab7b65b76787735956702f6c7b8f048cabe46c2117107953d7

          • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\usertile40.bmp

            Filesize

            48KB

            MD5

            8850c1f63d9932bb2d8e957ed72d8fdf

            SHA1

            44271a436bed981ced2c5f3839733bbaa54dc8e3

            SHA256

            419b5f32629b747ac897aa66acf77ef2320d4f066470d616e21fd248a4a55f29

            SHA512

            8a33601de5ae88e7dc7aac1325514f68c5e8e40fc7514fa1d1542e78fddeb6612b26a04bd109e40efc36efb591f5bef48693a918219b9e56598677cb26e1978f

          • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

            Filesize

            726KB

            MD5

            6ea8a6cc5fed6c664df1b3ef7c56b55d

            SHA1

            6b244d708706441095ae97294928967ddf28432b

            SHA256

            2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

            SHA512

            4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

          • \??\c:\program files (x86)\windows media player\en-us\setup.dll

            Filesize

            726KB

            MD5

            3b8c01a632d938578eef896ccd41671e

            SHA1

            34fc63311001e746be782c7e5c521f6de0c06560

            SHA256

            0755d71814ba2bc900f80a18a843e8c90ce7e835470feed459e8aa7b7d5230b0

            SHA512

            6bdb9963b49f636abfb1634aa51608caa21c64eb7c6f6b88d98a8ca6184dd01714bacdb0f101e33921d271b70d34b5189a81d715ee231f15245fdbf34a0052d8

          • \Program Files (x86)\Windows Media Player\en-US\setup.dll

            Filesize

            726KB

            MD5

            3b8c01a632d938578eef896ccd41671e

            SHA1

            34fc63311001e746be782c7e5c521f6de0c06560

            SHA256

            0755d71814ba2bc900f80a18a843e8c90ce7e835470feed459e8aa7b7d5230b0

            SHA512

            6bdb9963b49f636abfb1634aa51608caa21c64eb7c6f6b88d98a8ca6184dd01714bacdb0f101e33921d271b70d34b5189a81d715ee231f15245fdbf34a0052d8

          • \Program Files (x86)\Windows Media Player\en-US\setup.dll

            Filesize

            726KB

            MD5

            3b8c01a632d938578eef896ccd41671e

            SHA1

            34fc63311001e746be782c7e5c521f6de0c06560

            SHA256

            0755d71814ba2bc900f80a18a843e8c90ce7e835470feed459e8aa7b7d5230b0

            SHA512

            6bdb9963b49f636abfb1634aa51608caa21c64eb7c6f6b88d98a8ca6184dd01714bacdb0f101e33921d271b70d34b5189a81d715ee231f15245fdbf34a0052d8

          • \Program Files (x86)\Windows Media Player\en-US\setup.dll

            Filesize

            726KB

            MD5

            3b8c01a632d938578eef896ccd41671e

            SHA1

            34fc63311001e746be782c7e5c521f6de0c06560

            SHA256

            0755d71814ba2bc900f80a18a843e8c90ce7e835470feed459e8aa7b7d5230b0

            SHA512

            6bdb9963b49f636abfb1634aa51608caa21c64eb7c6f6b88d98a8ca6184dd01714bacdb0f101e33921d271b70d34b5189a81d715ee231f15245fdbf34a0052d8

          • \Program Files (x86)\Windows Media Player\en-US\setup.dll

            Filesize

            726KB

            MD5

            3b8c01a632d938578eef896ccd41671e

            SHA1

            34fc63311001e746be782c7e5c521f6de0c06560

            SHA256

            0755d71814ba2bc900f80a18a843e8c90ce7e835470feed459e8aa7b7d5230b0

            SHA512

            6bdb9963b49f636abfb1634aa51608caa21c64eb7c6f6b88d98a8ca6184dd01714bacdb0f101e33921d271b70d34b5189a81d715ee231f15245fdbf34a0052d8

          • \Program Files (x86)\Windows Media Player\en-US\setup.dll

            Filesize

            726KB

            MD5

            3b8c01a632d938578eef896ccd41671e

            SHA1

            34fc63311001e746be782c7e5c521f6de0c06560

            SHA256

            0755d71814ba2bc900f80a18a843e8c90ce7e835470feed459e8aa7b7d5230b0

            SHA512

            6bdb9963b49f636abfb1634aa51608caa21c64eb7c6f6b88d98a8ca6184dd01714bacdb0f101e33921d271b70d34b5189a81d715ee231f15245fdbf34a0052d8

          • \Program Files\Mozilla Firefox\firefox.exe

            Filesize

            562KB

            MD5

            d388df6ed5ccbf1acdeda5af2d18cb0b

            SHA1

            124d3c2ba93644ac6c2d7253de242b46be836692

            SHA256

            8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

            SHA512

            f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

          • \Program Files\Mozilla Firefox\firefox.exe

            Filesize

            562KB

            MD5

            d388df6ed5ccbf1acdeda5af2d18cb0b

            SHA1

            124d3c2ba93644ac6c2d7253de242b46be836692

            SHA256

            8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

            SHA512

            f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

          • \Program Files\Mozilla Firefox\firefox.exe

            Filesize

            562KB

            MD5

            d388df6ed5ccbf1acdeda5af2d18cb0b

            SHA1

            124d3c2ba93644ac6c2d7253de242b46be836692

            SHA256

            8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

            SHA512

            f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

          • \Program Files\Mozilla Firefox\firefox.exe

            Filesize

            562KB

            MD5

            d388df6ed5ccbf1acdeda5af2d18cb0b

            SHA1

            124d3c2ba93644ac6c2d7253de242b46be836692

            SHA256

            8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

            SHA512

            f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

          • \Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

            Filesize

            726KB

            MD5

            6ea8a6cc5fed6c664df1b3ef7c56b55d

            SHA1

            6b244d708706441095ae97294928967ddf28432b

            SHA256

            2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

            SHA512

            4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

          • memory/1072-67-0x0000000004A70000-0x0000000004BB0000-memory.dmp

            Filesize

            1.2MB

          • memory/1072-72-0x0000000004A70000-0x0000000004BB0000-memory.dmp

            Filesize

            1.2MB

          • memory/1072-80-0x0000000004340000-0x0000000004A65000-memory.dmp

            Filesize

            7.1MB

          • memory/1072-71-0x0000000004A70000-0x0000000004BB0000-memory.dmp

            Filesize

            1.2MB

          • memory/1072-73-0x0000000004A70000-0x0000000004BB0000-memory.dmp

            Filesize

            1.2MB

          • memory/1072-63-0x0000000004340000-0x0000000004A65000-memory.dmp

            Filesize

            7.1MB

          • memory/1072-65-0x0000000004340000-0x0000000004A65000-memory.dmp

            Filesize

            7.1MB

          • memory/1072-68-0x0000000004A70000-0x0000000004BB0000-memory.dmp

            Filesize

            1.2MB

          • memory/1072-66-0x0000000004A70000-0x0000000004BB0000-memory.dmp

            Filesize

            1.2MB

          • memory/1092-58-0x0000000001E70000-0x0000000001F85000-memory.dmp

            Filesize

            1.1MB

          • memory/1092-54-0x0000000000520000-0x00000000005F6000-memory.dmp

            Filesize

            856KB

          • memory/1092-60-0x0000000000400000-0x0000000000517000-memory.dmp

            Filesize

            1.1MB

          • memory/1092-57-0x0000000000520000-0x00000000005F6000-memory.dmp

            Filesize

            856KB

          • memory/1092-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

            Filesize

            8KB

          • memory/1164-103-0x0000000003910000-0x0000000004035000-memory.dmp

            Filesize

            7.1MB

          • memory/1164-106-0x0000000003910000-0x0000000004035000-memory.dmp

            Filesize

            7.1MB

          • memory/1164-105-0x0000000003910000-0x0000000004035000-memory.dmp

            Filesize

            7.1MB

          • memory/1424-85-0x00000000039B0000-0x00000000040D5000-memory.dmp

            Filesize

            7.1MB

          • memory/1424-87-0x00000000039B0000-0x00000000040D5000-memory.dmp

            Filesize

            7.1MB

          • memory/1424-97-0x00000000039B0000-0x00000000040D5000-memory.dmp

            Filesize

            7.1MB

          • memory/1992-79-0x0000000001FC0000-0x00000000021EA000-memory.dmp

            Filesize

            2.2MB

          • memory/1992-77-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

            Filesize

            8KB

          • memory/1992-69-0x0000000000280000-0x0000000000499000-memory.dmp

            Filesize

            2.1MB

          • memory/1992-76-0x00000000023A0000-0x00000000024E0000-memory.dmp

            Filesize

            1.2MB

          • memory/1992-75-0x00000000023A0000-0x00000000024E0000-memory.dmp

            Filesize

            1.2MB

          • memory/1992-78-0x0000000000280000-0x0000000000499000-memory.dmp

            Filesize

            2.1MB