Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2022, 13:20

General

  • Target

    file.exe

  • Size

    311KB

  • MD5

    a034cbb1ffdcc27f1eb9d3e90d03a638

  • SHA1

    88d16b6e1b93389a89a2b86a6d57c512b57b678d

  • SHA256

    423836be3f255bb3f0f2a2524cd24b979ab2f6f8149fd518790de7c4e1b63d02

  • SHA512

    cae1ba18bd3483c34a2d13731c8e9fdd7cec0d0121b62f842b8eb6fda97f5032af0970f149da953a01ea7bebdd828ffc003a5abc45936c56d4c08b3a109d2376

  • SSDEEP

    6144:40AALtEZ8Ubf52YC96UOQ8IXa1atOgkfH4rWlRjO1n:407hEZ8UbtC4UE1wOgjrW9u

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4772
  • C:\Users\Admin\AppData\Local\Temp\ED7D.exe
    C:\Users\Admin\AppData\Local\Temp\ED7D.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:344
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23958
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:2104
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 536
      2⤵
      • Program crash
      PID:1816
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4020 -ip 4020
    1⤵
      PID:1240
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:780

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\ED7D.exe

              Filesize

              1.1MB

              MD5

              8a4cb873c04ffe6859dd5bb381fed9b2

              SHA1

              c71cb06097a8172057c7dd0ca61c27e164c1939a

              SHA256

              c51c27c86facb3ce46801e6a9f900292b5ba336760708438483e5246b7440029

              SHA512

              352510a901636c9880afea8bdb1b9a8da63bed989b959ef1a560ec6baf59ea09ada9b04f853a838938510507b0d4d3aab484b46876a9801d7f9b138af7bd0fbd

            • C:\Users\Admin\AppData\Local\Temp\ED7D.exe

              Filesize

              1.1MB

              MD5

              8a4cb873c04ffe6859dd5bb381fed9b2

              SHA1

              c71cb06097a8172057c7dd0ca61c27e164c1939a

              SHA256

              c51c27c86facb3ce46801e6a9f900292b5ba336760708438483e5246b7440029

              SHA512

              352510a901636c9880afea8bdb1b9a8da63bed989b959ef1a560ec6baf59ea09ada9b04f853a838938510507b0d4d3aab484b46876a9801d7f9b138af7bd0fbd

            • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

              Filesize

              726KB

              MD5

              6ea8a6cc5fed6c664df1b3ef7c56b55d

              SHA1

              6b244d708706441095ae97294928967ddf28432b

              SHA256

              2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

              SHA512

              4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

            • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

              Filesize

              726KB

              MD5

              6ea8a6cc5fed6c664df1b3ef7c56b55d

              SHA1

              6b244d708706441095ae97294928967ddf28432b

              SHA256

              2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

              SHA512

              4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

            • memory/344-146-0x0000000005C00000-0x0000000006325000-memory.dmp

              Filesize

              7.1MB

            • memory/344-147-0x0000000004950000-0x0000000004A90000-memory.dmp

              Filesize

              1.2MB

            • memory/344-159-0x0000000005C00000-0x0000000006325000-memory.dmp

              Filesize

              7.1MB

            • memory/344-154-0x00000000049C9000-0x00000000049CB000-memory.dmp

              Filesize

              8KB

            • memory/344-151-0x0000000004950000-0x0000000004A90000-memory.dmp

              Filesize

              1.2MB

            • memory/344-152-0x0000000004950000-0x0000000004A90000-memory.dmp

              Filesize

              1.2MB

            • memory/344-150-0x0000000004950000-0x0000000004A90000-memory.dmp

              Filesize

              1.2MB

            • memory/344-149-0x0000000004950000-0x0000000004A90000-memory.dmp

              Filesize

              1.2MB

            • memory/344-145-0x0000000005C00000-0x0000000006325000-memory.dmp

              Filesize

              7.1MB

            • memory/344-148-0x0000000004950000-0x0000000004A90000-memory.dmp

              Filesize

              1.2MB

            • memory/2104-155-0x0000019C1B1F0000-0x0000019C1B330000-memory.dmp

              Filesize

              1.2MB

            • memory/2104-156-0x0000019C1B1F0000-0x0000019C1B330000-memory.dmp

              Filesize

              1.2MB

            • memory/2104-157-0x0000000000F40000-0x0000000001159000-memory.dmp

              Filesize

              2.1MB

            • memory/2104-158-0x0000019C1B370000-0x0000019C1B59A000-memory.dmp

              Filesize

              2.2MB

            • memory/4020-144-0x0000000000400000-0x0000000000517000-memory.dmp

              Filesize

              1.1MB

            • memory/4020-143-0x00000000022F0000-0x0000000002405000-memory.dmp

              Filesize

              1.1MB

            • memory/4020-142-0x0000000002112000-0x00000000021E8000-memory.dmp

              Filesize

              856KB

            • memory/4772-132-0x0000000000799000-0x00000000007AF000-memory.dmp

              Filesize

              88KB

            • memory/4772-133-0x00000000006F0000-0x00000000006F9000-memory.dmp

              Filesize

              36KB

            • memory/4772-134-0x0000000000400000-0x0000000000453000-memory.dmp

              Filesize

              332KB

            • memory/4772-135-0x0000000000400000-0x0000000000453000-memory.dmp

              Filesize

              332KB