Analysis

  • max time kernel
    148s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2022, 11:40

General

  • Target

    c51c27c86facb3ce46801e6a9f900292b5ba336760708438483e5246b7440029.exe

  • Size

    1.1MB

  • MD5

    8a4cb873c04ffe6859dd5bb381fed9b2

  • SHA1

    c71cb06097a8172057c7dd0ca61c27e164c1939a

  • SHA256

    c51c27c86facb3ce46801e6a9f900292b5ba336760708438483e5246b7440029

  • SHA512

    352510a901636c9880afea8bdb1b9a8da63bed989b959ef1a560ec6baf59ea09ada9b04f853a838938510507b0d4d3aab484b46876a9801d7f9b138af7bd0fbd

  • SSDEEP

    24576:cV/Gyl0a5nGoVsJIsk/DVdmsbzK8+2HDE0j1D3W9:u1F5nnsJvk/Tmsb2sHB7W9

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 4 IoCs
  • Sets DLL path for service in the registry 2 TTPs 2 IoCs
  • Sets service image path in registry 2 TTPs 5 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 45 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 58 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c51c27c86facb3ce46801e6a9f900292b5ba336760708438483e5246b7440029.exe
    "C:\Users\Admin\AppData\Local\Temp\c51c27c86facb3ce46801e6a9f900292b5ba336760708438483e5246b7440029.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:3324
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23949
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1664
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:2140
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:1616
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 536
          2⤵
          • Program crash
          PID:672
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4712 -ip 4712
        1⤵
          PID:4744
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:2020
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\SysWOW64\svchost.exe -k LocalService
            1⤵
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3172
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\close_x.dll",QgU9RQ==
              2⤵
              • Loads dropped DLL
              • Checks processor information in registry
              PID:3660

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\WindowsPowerShell\Modules\close_x.dll

                  Filesize

                  726KB

                  MD5

                  b9ee2129ea48aabb9c3d65b5e0b864db

                  SHA1

                  8c831d7b63a83af40c8d01e51243679d40dc6726

                  SHA256

                  6752148c44e9204a63cc22d560a954aceafdccdabd18f61b588ef9fdcfeaa899

                  SHA512

                  e8309cb674f4bb73f4bc8b1b87684b8491587872f3751f08312658d70fd34bb8b93f0baf1b6e466a2c11873c6e5bfd71154ebb9187c6950a15935309d085f119

                • C:\Program Files (x86)\WindowsPowerShell\Modules\close_x.dll

                  Filesize

                  726KB

                  MD5

                  b9ee2129ea48aabb9c3d65b5e0b864db

                  SHA1

                  8c831d7b63a83af40c8d01e51243679d40dc6726

                  SHA256

                  6752148c44e9204a63cc22d560a954aceafdccdabd18f61b588ef9fdcfeaa899

                  SHA512

                  e8309cb674f4bb73f4bc8b1b87684b8491587872f3751f08312658d70fd34bb8b93f0baf1b6e466a2c11873c6e5bfd71154ebb9187c6950a15935309d085f119

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml

                  Filesize

                  23KB

                  MD5

                  37cde9afb1540513bd564d71867021e0

                  SHA1

                  e319abb6093025dccc55618fb407c1182ccdafe7

                  SHA256

                  516aa640a48752bcadbd46e4f53c0560a1cb379d5366b1c9bb4d0706d1bd040f

                  SHA512

                  6746350447a6a0424c90571c7cc3442d34af0cb16fa1459bb76b25423f165f474073f1d359462cb805ac376a9d069236d6b7a796332c27253a4807f691292881

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\C2RManifest.dcfmui.msi.16.en-us.xml

                  Filesize

                  9KB

                  MD5

                  2693cb4d0d47298d60c5b4210d567e56

                  SHA1

                  20b67bce8310a93c5756d83d13febdcaff5f3b39

                  SHA256

                  d98dec16b13c3e4a23823be0bcd45f685c6dc690ae28954c0c18075e77898f20

                  SHA512

                  034cb9620ea7f9aa793ad8e0c8e30b11244e7952d871d1f8cbb1ff6daa765fd9afc2a54f221f0a323511f4aa7b985ff61c2f0b983668c7e390f3f99699dc89c9

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\C2RManifest.powerpointmui.msi.16.en-us.xml

                  Filesize

                  27KB

                  MD5

                  e9ed7134ebf28fea3f7aa5691a28438a

                  SHA1

                  ea1e55c279ed9f8dae333ae436204d8d67d46adf

                  SHA256

                  8fe0a353ce49d8bf91b019174a72f92c70870d8215b3afa565a01eb041569e28

                  SHA512

                  535d34d3e428d421793e147e8bf1e344e9a2da449ce25103bf4d72c7b421db429304d5eaebbe305ac566b4b172984677885dcab2aa118441a3df38c57fd04dd9

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\C2RManifest.proofing.msi.16.en-us.xml

                  Filesize

                  1KB

                  MD5

                  d23cf0da0462ecbb77509f23f26edc57

                  SHA1

                  b0a3353089a1c174a092e7a791d286bb28bb764c

                  SHA256

                  9fc823530ff0f81c7064fb67d0f6932ad735897a2f5479a8f1d298075b04817f

                  SHA512

                  a113d35757e4abebede230ca695b2163f44910bdca6253ad65d3649ab1cdaa16da966f01dc1c85d782ed775757915c130e39d6aa008ff5b926674ac353d23dff

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\DiagnosticLogCSP_Collector_DeviceProvisioning_2022_11_11_13_34_6.etl

                  Filesize

                  256KB

                  MD5

                  1fe0d68375877cabfccb619d9d4ab43f

                  SHA1

                  cf193c9d2867df41dcccb8f6aabf425dffb509eb

                  SHA256

                  0cb5476c09391a9aa162dab319070f54ad3befb8cb202acfd274613985912aea

                  SHA512

                  51370046f065ae8b86afe3cc5f0ec7e71b13d6bc3272db4bf16924cbdfdc126e5b10399055756234e776a44a0449d2d1554ca0097e7d72790713ca618fdc7ec1

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.Microsoft3DViewer_6.1908.2042.0_neutral_~_8wekyb3d8bbwe.xml

                  Filesize

                  7KB

                  MD5

                  f4b603547f83e5cb97e4ad4538aac812

                  SHA1

                  c225c8c582ad9fdd9e81291fcb4af711deb92508

                  SHA256

                  268d79fcfc4de72faeb0433e371176fedcfc0c33b0c9484b02c9936c3c6d4218

                  SHA512

                  d285740008ed9e6dbfc4284dfb5418e130f1eb4b2fb758fb2f8e86e0c5c557e050b415eaa66858c37cd95ddfd4ed6a40be77a333f254ec142982d2e3f3cc37cf

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe.xml

                  Filesize

                  913B

                  MD5

                  1600f66ce0d9c342eb6a49155a2f8c14

                  SHA1

                  e13fdac3eb45a9d47f965b2f2cf7f2ff4893af07

                  SHA256

                  8dcf324dfacd70d3e32cd9423bf9067f3cbc50929dee5154bdaa531c84a9dc27

                  SHA512

                  ed27ee001fefa4d7ae3ab0fe2cb1059f277692eb0b6fddb6092467ec67cfdacc3db2252e8700095ccaf503e7ca0c7942771614b1b2a0b800fd27daa30ebb5b00

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftOutlook2016CAWin64.xml

                  Filesize

                  1KB

                  MD5

                  4b6a6960b925c7bd5b83d8a4196e24e4

                  SHA1

                  f1bb8a50ffb8cce0804db90d2e3ecdbbbe3f460b

                  SHA256

                  5f45e2be37f33052a97235462325f5ae32d3713bdaa6eeeea49e92f0e9fc6ed0

                  SHA512

                  21f420212c86df357ad83079876d969bab0d089ac506d3dcfb1cfcb134f118a741491454e79538bf5c8d4d2b2ab1fc14d07d0cc3f263874396bd9546bf3b71b1

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

                  Filesize

                  2.3MB

                  MD5

                  fbdd6a9ef07c99e35a1c8e5db6b4cfc7

                  SHA1

                  6af5ca47ff3ccf080cd2ccd7f95697660edccfb3

                  SHA256

                  f66ceb064373b3cdac7da9bb32b15622d03b17ca9d658950d50435358e394cd9

                  SHA512

                  c84d726d7e5ec609913c2e58c4b75528f80466ab614aa16167b0f91f48e4102c1a5943ff68b6b2cd6229d30ef95ae82a028ab1b5036d1410dd1e485f6dcab10c

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\telemetry.ASM-WindowsDefault.json

                  Filesize

                  146KB

                  MD5

                  d054101b077a5d6ee42f48bbe0a98033

                  SHA1

                  e27de6db98d496419be668cdbb0d63693353a08a

                  SHA256

                  b44915e8ebc59eb07e1571de5dfe8e7ae87aca64b2aa64bd5aaf3ebfe06f72a8

                  SHA512

                  364a15229a7563af5657355b3ec6838f1367f89163fa43cf835756d5b3ae7df1fbd6b577d31f275b5030f00255c2a1958c6d88b43e84b283a602931c9af1921b

                • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\wmp.ico

                  Filesize

                  110KB

                  MD5

                  589ff0b7d4d0d3fced65c3eae6559657

                  SHA1

                  4be3e4221a429b347888bbe3635e377271974c7f

                  SHA256

                  0e96c027d23a57e95103d1b64e4c5b8a153402f05b756dfcb737459476aaae35

                  SHA512

                  4a12bac3f61964d6c5608bbb9067d7673cd5e5a22463f6d16f402954045692f43ef1ea32d405f452d415c859c30b217e9d250a1c5c85cfd629bd393824b6523b

                • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

                  Filesize

                  726KB

                  MD5

                  6ea8a6cc5fed6c664df1b3ef7c56b55d

                  SHA1

                  6b244d708706441095ae97294928967ddf28432b

                  SHA256

                  2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

                  SHA512

                  4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

                • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

                  Filesize

                  726KB

                  MD5

                  6ea8a6cc5fed6c664df1b3ef7c56b55d

                  SHA1

                  6b244d708706441095ae97294928967ddf28432b

                  SHA256

                  2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

                  SHA512

                  4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

                • \??\c:\program files (x86)\windowspowershell\modules\close_x.dll

                  Filesize

                  726KB

                  MD5

                  b9ee2129ea48aabb9c3d65b5e0b864db

                  SHA1

                  8c831d7b63a83af40c8d01e51243679d40dc6726

                  SHA256

                  6752148c44e9204a63cc22d560a954aceafdccdabd18f61b588ef9fdcfeaa899

                  SHA512

                  e8309cb674f4bb73f4bc8b1b87684b8491587872f3751f08312658d70fd34bb8b93f0baf1b6e466a2c11873c6e5bfd71154ebb9187c6950a15935309d085f119

                • memory/1664-150-0x000001F6CA5C0000-0x000001F6CA7EA000-memory.dmp

                  Filesize

                  2.2MB

                • memory/1664-147-0x000001F6CBE00000-0x000001F6CBF40000-memory.dmp

                  Filesize

                  1.2MB

                • memory/1664-149-0x00000000000A0000-0x00000000002B9000-memory.dmp

                  Filesize

                  2.1MB

                • memory/1664-148-0x000001F6CBE00000-0x000001F6CBF40000-memory.dmp

                  Filesize

                  1.2MB

                • memory/3172-173-0x0000000003960000-0x0000000004085000-memory.dmp

                  Filesize

                  7.1MB

                • memory/3172-155-0x0000000003960000-0x0000000004085000-memory.dmp

                  Filesize

                  7.1MB

                • memory/3172-168-0x0000000003960000-0x0000000004085000-memory.dmp

                  Filesize

                  7.1MB

                • memory/3324-140-0x00000000048E0000-0x0000000004A20000-memory.dmp

                  Filesize

                  1.2MB

                • memory/3324-145-0x00000000048E0000-0x0000000004A20000-memory.dmp

                  Filesize

                  1.2MB

                • memory/3324-138-0x0000000004010000-0x0000000004735000-memory.dmp

                  Filesize

                  7.1MB

                • memory/3324-151-0x0000000004010000-0x0000000004735000-memory.dmp

                  Filesize

                  7.1MB

                • memory/3324-143-0x00000000048E0000-0x0000000004A20000-memory.dmp

                  Filesize

                  1.2MB

                • memory/3324-139-0x0000000004010000-0x0000000004735000-memory.dmp

                  Filesize

                  7.1MB

                • memory/3324-141-0x00000000048E0000-0x0000000004A20000-memory.dmp

                  Filesize

                  1.2MB

                • memory/3324-144-0x00000000048E0000-0x0000000004A20000-memory.dmp

                  Filesize

                  1.2MB

                • memory/3324-142-0x00000000048E0000-0x0000000004A20000-memory.dmp

                  Filesize

                  1.2MB

                • memory/3660-169-0x0000000004880000-0x0000000004FA5000-memory.dmp

                  Filesize

                  7.1MB

                • memory/3660-170-0x0000000004880000-0x0000000004FA5000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4712-133-0x000000000229B000-0x0000000002371000-memory.dmp

                  Filesize

                  856KB

                • memory/4712-137-0x0000000000400000-0x0000000000517000-memory.dmp

                  Filesize

                  1.1MB

                • memory/4712-136-0x0000000002380000-0x0000000002495000-memory.dmp

                  Filesize

                  1.1MB