Analysis

  • max time kernel
    126s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2022, 10:54

General

  • Target

    bf8c7929bc3f4fad1da578dd2b73cc0d.exe

  • Size

    1.1MB

  • MD5

    bf8c7929bc3f4fad1da578dd2b73cc0d

  • SHA1

    716a6662f38f3ebb7b2081cf620fc2bf58b4d21e

  • SHA256

    aa123ff84c9fc24ff4fd58d0b5796b6b176976774b877efd9ec1c8263e87b08f

  • SHA512

    afbc94473c1518114649de98a7fedfb24f842beb98a6129611850c93190467bc117552022b9ad678cb4138995c1c0ce0cfdb27010b6825c9b4bc1847d920e9ab

  • SSDEEP

    24576:6TEz/u9UBBbf5Sk58avkQEEznMQZspzW5dgZhifsS5iW9:6i/uAxf3irwbwmdE7W9

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 3 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 60 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf8c7929bc3f4fad1da578dd2b73cc0d.exe
    "C:\Users\Admin\AppData\Local\Temp\bf8c7929bc3f4fad1da578dd2b73cc0d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:5040
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23986
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:224
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:1376
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:3908
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 556
          2⤵
          • Program crash
          PID:644
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4436 -ip 4436
        1⤵
          PID:5032
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:3296
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\SysWOW64\svchost.exe -k LocalService
            1⤵
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4460
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\cpdf_rhp..dll",f1coTVZHMg==
              2⤵
              • Loads dropped DLL
              • Checks processor information in registry
              PID:1852

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\WindowsPowerShell\Modules\CPDF_RHP..dll

                  Filesize

                  726KB

                  MD5

                  880da7026523afdebf6a98e74fd307ff

                  SHA1

                  8b747e37a942136a6e5c53deacc5ed60dea6e15c

                  SHA256

                  7c465ca42e5c8a89040d012d2986e2b76856e2ca9c6898dddb7821c11460b815

                  SHA512

                  92d51a54140630648d536322bd429e67d2a48cfad66b7c2e407dc75a43f55fd3e5e6207684845a5bcdfd2d9418dd28f5b550ab5228bca3d15a8bae789e39fc6d

                • C:\Program Files (x86)\WindowsPowerShell\Modules\CPDF_RHP..dll

                  Filesize

                  726KB

                  MD5

                  880da7026523afdebf6a98e74fd307ff

                  SHA1

                  8b747e37a942136a6e5c53deacc5ed60dea6e15c

                  SHA256

                  7c465ca42e5c8a89040d012d2986e2b76856e2ca9c6898dddb7821c11460b815

                  SHA512

                  92d51a54140630648d536322bd429e67d2a48cfad66b7c2e407dc75a43f55fd3e5e6207684845a5bcdfd2d9418dd28f5b550ab5228bca3d15a8bae789e39fc6d

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MasterDescriptor.x-none.xml

                  Filesize

                  27KB

                  MD5

                  82c3ab31834272e4118e925922249240

                  SHA1

                  a116ca5af39e39b7d4234c2c0cd6a91bff6727af

                  SHA256

                  25b87fbabbec1d49eae7cf47c3d659cb6c99eb82203e90eee6035b21b425b5ef

                  SHA512

                  4d3eaec898ef47e9b6039bcd481a06001263e7fcbc9303974423f90058a4d91494392427ca35dced5db642e8692580f24cb761b27a60e3288f15aefd8dbdb647

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe.xml

                  Filesize

                  58KB

                  MD5

                  ca7452f3c00cc3083d549346e3726b1c

                  SHA1

                  64c6e09bffa49ef36ab0ac3a7a0d98ff944eb89a

                  SHA256

                  a8736abe4c9f3715f7f737db3437af332373204263e458978f653a1c860f088b

                  SHA512

                  1a307069368230702b9d397640e4ae16cad64958aea87437b9d0c443a43242d0e72bab932be1a5fa294138c792cdbd0752edb783afe51d253cb7502fa0bc719d

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe.xml

                  Filesize

                  2KB

                  MD5

                  c8d6f0d26db52746e243b785c269cacd

                  SHA1

                  b06dc537fb0bbd424c0bb0c7a5ee0a85839e04f1

                  SHA256

                  d3352e34ef1b362934f938a2c2710261ca18c5e5e4922167a73539d945a95e21

                  SHA512

                  c674886978f91b35978544ad18ceb54aa7b2d8dfd8d9e0ddb752854ef211539e79a24d553d9a1a91c7e6711743e2bbd70c24611dac063c2d61379cc7f8ef3020

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftSkypeForBusiness2016Win64.xml

                  Filesize

                  2KB

                  MD5

                  bd044f090776619270e4e49b20dd006f

                  SHA1

                  8279e5b49f7322f11364ff10d694578b56fafcd2

                  SHA256

                  40ad82a3af39ac5ecca299f7d0c57a8de41c75c96e2c0fa49c0dcb5b442f14cf

                  SHA512

                  19214b4e046c1146ca1e06a35f69daaccf604b7fb42f6d6050794874e4bab03c6bbff66e68e7d9243265c246126d9231fe24ff633a6adcbcffd7a0831f91deaf

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\RoamingCredentialSettings.xml

                  Filesize

                  3KB

                  MD5

                  a186bfcab0d099811bf38b4c09102755

                  SHA1

                  9aadb653c69a0009f39d187a76ba51c0869ff9f2

                  SHA256

                  88b885c0292640fbbde80bbe0764b23e4d9621b89b9077056c0e12bc2deb7e2f

                  SHA512

                  c0e7cc96ee60aa8abe6e9ddbb3eef76561ff332f32fcc1acc950fcd4a03e958eab40590bb5e6912771950c8110838831f265199b040934e1aa3e5224bd33443f

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

                  Filesize

                  2.3MB

                  MD5

                  9fe39627a8722a7a447a50db5af2fad7

                  SHA1

                  11f71c56bbc752f65aae9029ea2f896b7d27c1d3

                  SHA256

                  65c5873d5f2342b4bd23691667578d14ea059e7c81ca0129aca6e05441adfde5

                  SHA512

                  bb4838b79dca928ceae04bb045ef8869a4d2acf87b3fd28477b437a3af15accb661b1ae87182a340742d0a28f62b37b44e2b15ac3f69f086886b1038415188ab

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\SmsInterceptStore.db

                  Filesize

                  192KB

                  MD5

                  7d2d2f04320584e023a549be0319e601

                  SHA1

                  d76db1f1a9aec376cc9b518ea1ef35ccc93d0e65

                  SHA256

                  9b1d9752ffaff1f6b931a2c43d03033591aad5f9c6afb7387ee6ce4d0986be5c

                  SHA512

                  9f4c3cbeccb1904687f7c6096eb3898c6ede187ed072b7ddb5ec3daafbe7c0ac56a94722395ce6e04ae8d520215f62ca33d0453505ec8f0eca460e50cf3f29cc

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\SystemIndex.1.gthr

                  Filesize

                  10KB

                  MD5

                  5d8e3f0dee1f1dcc69de24d4a01ea0dd

                  SHA1

                  54a4b7be8e07f172c366da7a25d56814512ffa2f

                  SHA256

                  beb289a769e447be982476cbb39e5fc628f8048b91c44af36ec4d43362ab0b2f

                  SHA512

                  d14e7c1893229188d8fd5d7eac1552be82f5b81c4c9ab6a908db49d4ffc0022601f5b1d2aaf1939c33aaba25e4a8c3b1cb8dd9715898bda1c90c3aa5db96c2ff

                • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

                  Filesize

                  726KB

                  MD5

                  6ea8a6cc5fed6c664df1b3ef7c56b55d

                  SHA1

                  6b244d708706441095ae97294928967ddf28432b

                  SHA256

                  2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

                  SHA512

                  4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

                • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

                  Filesize

                  726KB

                  MD5

                  6ea8a6cc5fed6c664df1b3ef7c56b55d

                  SHA1

                  6b244d708706441095ae97294928967ddf28432b

                  SHA256

                  2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

                  SHA512

                  4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

                • \??\c:\program files (x86)\windowspowershell\modules\cpdf_rhp..dll

                  Filesize

                  726KB

                  MD5

                  880da7026523afdebf6a98e74fd307ff

                  SHA1

                  8b747e37a942136a6e5c53deacc5ed60dea6e15c

                  SHA256

                  7c465ca42e5c8a89040d012d2986e2b76856e2ca9c6898dddb7821c11460b815

                  SHA512

                  92d51a54140630648d536322bd429e67d2a48cfad66b7c2e407dc75a43f55fd3e5e6207684845a5bcdfd2d9418dd28f5b550ab5228bca3d15a8bae789e39fc6d

                • memory/224-154-0x000001434FE90000-0x00000143500BA000-memory.dmp

                  Filesize

                  2.2MB

                • memory/224-152-0x0000000000A30000-0x0000000000C49000-memory.dmp

                  Filesize

                  2.1MB

                • memory/224-149-0x00000143516D0000-0x0000014351810000-memory.dmp

                  Filesize

                  1.2MB

                • memory/224-150-0x00000143516D0000-0x0000014351810000-memory.dmp

                  Filesize

                  1.2MB

                • memory/224-151-0x000001434FE90000-0x00000143500BA000-memory.dmp

                  Filesize

                  2.2MB

                • memory/1852-169-0x0000000004710000-0x0000000004E35000-memory.dmp

                  Filesize

                  7.1MB

                • memory/1852-171-0x0000000004710000-0x0000000004E35000-memory.dmp

                  Filesize

                  7.1MB

                • memory/1852-170-0x0000000004710000-0x0000000004E35000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4436-138-0x0000000000400000-0x0000000000517000-memory.dmp

                  Filesize

                  1.1MB

                • memory/4436-132-0x0000000002280000-0x0000000002356000-memory.dmp

                  Filesize

                  856KB

                • memory/4436-133-0x00000000023F0000-0x0000000002505000-memory.dmp

                  Filesize

                  1.1MB

                • memory/4436-134-0x0000000000400000-0x0000000000517000-memory.dmp

                  Filesize

                  1.1MB

                • memory/4460-166-0x0000000003970000-0x0000000004095000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4460-158-0x0000000003970000-0x0000000004095000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4460-174-0x0000000003970000-0x0000000004095000-memory.dmp

                  Filesize

                  7.1MB

                • memory/5040-143-0x0000000004AF0000-0x0000000004C30000-memory.dmp

                  Filesize

                  1.2MB

                • memory/5040-146-0x0000000004AF0000-0x0000000004C30000-memory.dmp

                  Filesize

                  1.2MB

                • memory/5040-145-0x0000000004AF0000-0x0000000004C30000-memory.dmp

                  Filesize

                  1.2MB

                • memory/5040-144-0x0000000004AF0000-0x0000000004C30000-memory.dmp

                  Filesize

                  1.2MB

                • memory/5040-148-0x0000000004B69000-0x0000000004B6B000-memory.dmp

                  Filesize

                  8KB

                • memory/5040-142-0x0000000004AF0000-0x0000000004C30000-memory.dmp

                  Filesize

                  1.2MB

                • memory/5040-141-0x0000000004AF0000-0x0000000004C30000-memory.dmp

                  Filesize

                  1.2MB

                • memory/5040-140-0x00000000041A0000-0x00000000048C5000-memory.dmp

                  Filesize

                  7.1MB

                • memory/5040-139-0x00000000041A0000-0x00000000048C5000-memory.dmp

                  Filesize

                  7.1MB

                • memory/5040-153-0x00000000041A0000-0x00000000048C5000-memory.dmp

                  Filesize

                  7.1MB