Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2022 18:35

General

  • Target

    489437b24ecd011538918fbd80d3ad06dc2a2b63207dfe937bd3f6dcefe11a55.exe

  • Size

    307KB

  • MD5

    ddf6f2c3455fb5f4738536262dd38afe

  • SHA1

    f800d1f0f3b4de746a0663a13a4c8846b041404e

  • SHA256

    489437b24ecd011538918fbd80d3ad06dc2a2b63207dfe937bd3f6dcefe11a55

  • SHA512

    21ffe2954f3c2e42f4400dd3619c9632a8800812c8b9450c5594568ade56e3490b20f4aa0a8684bc53578daa637e7b42055c0771ff20d34e11b91e143899870a

  • SSDEEP

    6144:Bl5ULz/YGW19tz8bG5geqDGO1oK/Fn77jcJ0iPvzpQ6rFiaI:BY3/YGk9mbG54DG4ocFnixnzpQ6rF

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Detects Smokeloader packer 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\489437b24ecd011538918fbd80d3ad06dc2a2b63207dfe937bd3f6dcefe11a55.exe
    "C:\Users\Admin\AppData\Local\Temp\489437b24ecd011538918fbd80d3ad06dc2a2b63207dfe937bd3f6dcefe11a55.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4500
  • C:\Users\Admin\AppData\Local\Temp\F6B9.exe
    C:\Users\Admin\AppData\Local\Temp\F6B9.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4032
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14100
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:924
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 528
      2⤵
      • Program crash
      PID:1608
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4032 -ip 4032
    1⤵
      PID:4856
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3180

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\F6B9.exe

        Filesize

        1.1MB

        MD5

        f54e72ec43ba9b6d7dcb039cc2ad48f6

        SHA1

        4dd3e8194b67d5e594eee18101bee38a69d1343a

        SHA256

        106a8c05bd4fe5807019f19c99c66dd65166442148ab41a482944a06740dca2f

        SHA512

        50e425e51b2fe3a11e35499470c0cb9e571f82a1beff6acf21a061da53f278de362a7dd93b121408cf7a27421ff2a557e59c94943f9b3681dab7e023b64c7c3e

      • C:\Users\Admin\AppData\Local\Temp\F6B9.exe

        Filesize

        1.1MB

        MD5

        f54e72ec43ba9b6d7dcb039cc2ad48f6

        SHA1

        4dd3e8194b67d5e594eee18101bee38a69d1343a

        SHA256

        106a8c05bd4fe5807019f19c99c66dd65166442148ab41a482944a06740dca2f

        SHA512

        50e425e51b2fe3a11e35499470c0cb9e571f82a1beff6acf21a061da53f278de362a7dd93b121408cf7a27421ff2a557e59c94943f9b3681dab7e023b64c7c3e

      • C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

        Filesize

        797KB

        MD5

        24925b25552a7d8f1d3292071e545920

        SHA1

        f786e1d40df30f6fed0301d60c823b655f2d6eac

        SHA256

        9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

        SHA512

        242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

      • C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

        Filesize

        797KB

        MD5

        24925b25552a7d8f1d3292071e545920

        SHA1

        f786e1d40df30f6fed0301d60c823b655f2d6eac

        SHA256

        9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

        SHA512

        242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

      • memory/924-184-0x0000025097140000-0x0000025097280000-memory.dmp

        Filesize

        1.2MB

      • memory/924-183-0x0000025097140000-0x0000025097280000-memory.dmp

        Filesize

        1.2MB

      • memory/924-182-0x00007FF71ABB6890-mapping.dmp

      • memory/924-186-0x0000000000E20000-0x0000000001039000-memory.dmp

        Filesize

        2.1MB

      • memory/924-187-0x00000250972C0000-0x00000250974EA000-memory.dmp

        Filesize

        2.2MB

      • memory/1108-149-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-138-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-146-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-151-0x0000000003310000-0x0000000003320000-memory.dmp

        Filesize

        64KB

      • memory/1108-153-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-155-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-154-0x0000000007ED0000-0x0000000007EE0000-memory.dmp

        Filesize

        64KB

      • memory/1108-157-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-152-0x0000000007ED0000-0x0000000007EE0000-memory.dmp

        Filesize

        64KB

      • memory/1108-150-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-158-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-159-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-160-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-161-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-162-0x0000000007ED0000-0x0000000007EE0000-memory.dmp

        Filesize

        64KB

      • memory/1108-163-0x0000000007ED0000-0x0000000007EE0000-memory.dmp

        Filesize

        64KB

      • memory/1108-164-0x0000000007ED0000-0x0000000007EE0000-memory.dmp

        Filesize

        64KB

      • memory/1108-147-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-145-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-144-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-168-0x0000000007ED0000-0x0000000007EE0000-memory.dmp

        Filesize

        64KB

      • memory/1108-139-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-142-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-140-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-143-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/1108-141-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

        Filesize

        64KB

      • memory/3588-185-0x0000000004A79000-0x0000000004A7B000-memory.dmp

        Filesize

        8KB

      • memory/3588-175-0x0000000005CB0000-0x00000000063D5000-memory.dmp

        Filesize

        7.1MB

      • memory/3588-176-0x0000000004A00000-0x0000000004B40000-memory.dmp

        Filesize

        1.2MB

      • memory/3588-177-0x0000000004A00000-0x0000000004B40000-memory.dmp

        Filesize

        1.2MB

      • memory/3588-178-0x0000000004A00000-0x0000000004B40000-memory.dmp

        Filesize

        1.2MB

      • memory/3588-179-0x0000000004A00000-0x0000000004B40000-memory.dmp

        Filesize

        1.2MB

      • memory/3588-180-0x0000000004A00000-0x0000000004B40000-memory.dmp

        Filesize

        1.2MB

      • memory/3588-181-0x0000000004A00000-0x0000000004B40000-memory.dmp

        Filesize

        1.2MB

      • memory/3588-188-0x0000000005CB0000-0x00000000063D5000-memory.dmp

        Filesize

        7.1MB

      • memory/3588-169-0x0000000000000000-mapping.dmp

      • memory/4032-165-0x0000000000000000-mapping.dmp

      • memory/4032-174-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

      • memory/4032-173-0x00000000023E0000-0x0000000002510000-memory.dmp

        Filesize

        1.2MB

      • memory/4032-172-0x00000000021ED000-0x00000000022DB000-memory.dmp

        Filesize

        952KB

      • memory/4500-132-0x0000000000688000-0x000000000069E000-memory.dmp

        Filesize

        88KB

      • memory/4500-133-0x00000000005F0000-0x00000000005F9000-memory.dmp

        Filesize

        36KB

      • memory/4500-134-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

      • memory/4500-135-0x0000000000688000-0x000000000069E000-memory.dmp

        Filesize

        88KB

      • memory/4500-136-0x00000000005F0000-0x00000000005F9000-memory.dmp

        Filesize

        36KB

      • memory/4500-137-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB