danabot | ae9fc18e886fbf5071040cfe4ca2545ba25492c6fc43b9c10dc7c43520e6360c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2022 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b37cb232abca4e0345bc66dd7fabd08.exe
Size

304KB
MD5

5b37cb232abca4e0345bc66dd7fabd08
SHA1

6e233f50b18eb33ae5f27778a84bc90438b51884
SHA256

ae9fc18e886fbf5071040cfe4ca2545ba25492c6fc43b9c10dc7c43520e6360c
SHA512

7ca16431ff12628287a15adddca81e92992850593d15a25e9f89203957409f286e89cc4fa05758c060ad61647a0242209c04db31458e440d3f03488e53d908b8
SSDEEP

6144:EFLxGE756QHbWUtbxlZlqpQP63QZImQKG0:sVGE96QHKUblWpQQQZW

Score

10^/10

danabot smokeloader systembc backdoor banker persistence trojan

Malware Config

Extracted

Family

systembc

109.205.214.18:443

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2220-133-0x0000000002190000-0x0000000002199000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

60 176 rundll32.exe
63 176 rundll32.exe
114 176 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

D47B.exeFD71.exenidqn.exe

pid process

4112 D47B.exe
3164 FD71.exe
696 nidqn.exe

flow	pid	process
60	176	rundll32.exe
63	176	rundll32.exe
114	176	rundll32.exe

pid	process
4112	D47B.exe
3164	FD71.exe
696	nidqn.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\export\Parameters\ServiceDll = "C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\export.dll"	rundll32.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\export\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\export\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService⸀"	rundll32.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

176 rundll32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 176 set thread context of 3756 176 rundll32.exe rundll32.exe

pid	process
176	rundll32.exe

description	pid	process	target process
PID 176 set thread context of 3756	176	rundll32.exe	rundll32.exe

Drops file in Program Files directory 21 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Exp_RHP.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ExtendScript.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef.pak	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\StandardBusiness.pdf	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\QuickTime.mpp	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\DataMatrix.pmp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_issue.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\delete.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\nppdf32.dll	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\AdobePDF417.pmp	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\server_issue.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\AcroBroker.exe	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Edit_R_Exp_RHP.aapp	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\export.dll	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\delete.svg	rundll32.exe

Drops file in Windows directory 2 IoCs

Processes:

FD71.exe

description ioc process

File created C:\Windows\Tasks\nidqn.job FD71.exe
File opened for modification C:\Windows\Tasks\nidqn.job FD71.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3856 4112 WerFault.exe D47B.exe
532 3164 WerFault.exe FD71.exe

description	ioc	process
File created	C:\Windows\Tasks\nidqn.job	FD71.exe
File opened for modification	C:\Windows\Tasks\nidqn.job	FD71.exe

pid	pid_target	process	target process
3856	4112	WerFault.exe	D47B.exe
532	3164	WerFault.exe	FD71.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

5b37cb232abca4e0345bc66dd7fabd08.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5b37cb232abca4e0345bc66dd7fabd08.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5b37cb232abca4e0345bc66dd7fabd08.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5b37cb232abca4e0345bc66dd7fabd08.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Modifies registry class 30 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000009455f855100054656d7000003a0009000400efbe0c5519999455f9552e0000000000000000000000000000000000000000000000000099310601540065006d007000000014000000
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pid process

700

pid	process
700

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5b37cb232abca4e0345bc66dd7fabd08.exe

pid	process
2220	5b37cb232abca4e0345bc66dd7fabd08.exe
2220	5b37cb232abca4e0345bc66dd7fabd08.exe
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

700
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

5b37cb232abca4e0345bc66dd7fabd08.exe

pid process

2220 5b37cb232abca4e0345bc66dd7fabd08.exe

pid	process
700

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

3756 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pid process

700
700

pid	process
3756	rundll32.exe

pid	process
700
700

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

D47B.exerundll32.exe

description	pid	process	target process
PID 700 wrote to memory of 4112	700		D47B.exe
PID 700 wrote to memory of 4112	700		D47B.exe
PID 700 wrote to memory of 4112	700		D47B.exe
PID 4112 wrote to memory of 176	4112	D47B.exe	rundll32.exe
PID 4112 wrote to memory of 176	4112	D47B.exe	rundll32.exe
PID 4112 wrote to memory of 176	4112	D47B.exe	rundll32.exe
PID 700 wrote to memory of 3164	700		FD71.exe
PID 700 wrote to memory of 3164	700		FD71.exe
PID 700 wrote to memory of 3164	700		FD71.exe
PID 176 wrote to memory of 3756	176	rundll32.exe	rundll32.exe
PID 176 wrote to memory of 3756	176	rundll32.exe	rundll32.exe
PID 176 wrote to memory of 3756	176	rundll32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\5b37cb232abca4e0345bc66dd7fabd08.exe
"C:\Users\Admin\AppData\Local\Temp\5b37cb232abca4e0345bc66dd7fabd08.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2220

C:\Users\Admin\AppData\Local\Temp\D47B.exe
C:\Users\Admin\AppData\Local\Temp\D47B.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye
2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:176

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14144
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 528
2⤵
- Program crash
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4112 -ip 4112
1⤵
PID:3148

C:\Users\Admin\AppData\Local\Temp\FD71.exe
C:\Users\Admin\AppData\Local\Temp\FD71.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 492
2⤵
- Program crash
PID:532

C:\ProgramData\ccfqr\nidqn.exe
C:\ProgramData\ccfqr\nidqn.exe start
1⤵
- Executes dropped EXE
PID:696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3164 -ip 3164
1⤵
PID:4488

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k LocalService
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WindowsPowerShell\Modules\export.dll

Filesize
797KB

MD5
7b8c425b26102b03c7b986a6b7db4038

SHA1
c3db052baeb3436a1f822893692ec266935f3ac6

SHA256
83fb67f2ab79ab94e5af6a2b0cedee216ae20f4c8bd29d3df72730225061bbdd

SHA512
a0c5d9b051601a1ccbe8c2a706415eb7bb222aa6407e5fb3a23fd87592ec64f94ecfc80de9290d13a9b6253b0040a86419292d003b020d3d67180b0317dc47dc

Download Submit
C:\ProgramData\ccfqr\nidqn.exe

Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
C:\ProgramData\ccfqr\nidqn.exe

Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\15c6b44d3bdc8aff4e7c2c0d1f974574_e32e1c79-b88e-4709-94fb-81034ca3398e

Filesize
1KB

MD5
dafcaab9406d407da95a67947a3bcd56

SHA1
11aa14c87a59dce711083b624d6884923b15f705

SHA256
a478fe81f9ee06b7c2e00795db0869018e66b1d9f2add8c0dfb822d0f672cbba

SHA512
63553b12ed3c1226fd8a88d406d2ad23e7834a09ba42f0292405b8efa0e228c20d4742f0896b2ba5bed8cd890ca89decd4cfecfb205eb00cac16c4c119703670

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

Filesize
2.3MB

MD5
333f74459bb76fa741fdc2127cb7cafb

SHA1
de30e6b46314ea5779bb8587c37e189964e192a8

SHA256
7eae85ab19a425753db4c4d97dec5d3de8b8d0a3833cad268b61fee76a37a0a4

SHA512
c107b0a65bd683ecc220b96fbbdf8295db84a463d1486c8c8d641a887081bf101454ade61543861c09beb5c3da256bfb26fbe12e4324f2c1136ca4ffb05f2c26

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\RegisterInboxTemplates.ps1

Filesize
611B

MD5
05f7a98933d942ced40039a39cdb3fda

SHA1
c7d59ec61f4e454b0c8e38d921fb5e7f127ee46d

SHA256
a9b8f3753fb1adf3fdd9558cd49e0be28d0fd781eb192ff9e8b0cc736ee173eb

SHA512
dc01d47114be1fece3b4a87498194ae8c102d863f384e4b45009d5ddc8e1bfe77ecab99bf8ea76c53177a847b312f5a743ac9f06eb4a3619b91ec2adf19d4f34

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\SettingsLocationTemplate.xsd

Filesize
9KB

MD5
f35965aa615dd128c2b95cfe925145c3

SHA1
57346050388048feb8034d5011b105018483b4a0

SHA256
ea9674d42081557b34958b2f7085f8d3865e71660d8f36258fa1c088d90d2398

SHA512
82767fdf269f813b5d39bb44c481f01678f9eab332ecc42f11d5a4f00a1970a6dd1875d30a98042113d37b04e501414b33e18abf2ab2a7995e5e773489f9cd82

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\nidqn.exe

Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\resource.xml

Filesize
1KB

MD5
1d3eb6efb2054c0f8c6dfcc90af00e4e

SHA1
452b9ea9cfbf42179a4e344e38ebad3a7179ead7

SHA256
8fe6157bec03efbc921905d0df8f6f9f4432323f1244fc380ea404d5d0e2c95e

SHA512
a0aefd1bf5bc0b275fbba3af7d06c672d82f3c7b40046f3f11515c6f3467f704d668985816f31f97a64e16c8c1112d78ea1f277e9001a3ef4d65df626544fcaf

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\setup.exe

Filesize
453KB

MD5
96f7cb9f7481a279bd4bc0681a3b993e

SHA1
deaedb5becc6c0bd263d7cf81e0909b912a1afd4

SHA256
d2893c55259772b554cb887d3e2e1f9c67f5cd5abac2ab9f4720dec507cdd290

SHA512
694d2da36df04db25cc5972f7cc180b77e1cb0c3b5be8b69fe7e2d4e59555efb8aa7e50b1475ad5196ca638dabde2c796ae6faeb4a31f38166838cd1cc028149

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\stream.x64.en-us.hash

Filesize
128B

MD5
73f303800be636585f9ec14701cd8d5e

SHA1
456304dc888d5eaa159fa0fa34fc9bcc3bacb633

SHA256
c8e3762853e17a3bd49882b0d36afa285bed5639f8f9e88f716c3942e28b6ace

SHA512
8a80ee6d1b074d68a55bbb3d5be251cfaae89b0345a6b0e84a6359e8c1453c8bf0969e6d33a7d0523d30d586c46c1eede9e71f7a89f7bc67ea0ad866671b81b4

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\telemetry.P-ARIA-d5a8f02229be41efb047bd8f883ba799-59258264-451c-4459-8c09-75d7d721219a-7112.json

Filesize
121B

MD5
db33f35be3bf86a595c1c255fb0259f8

SHA1
90c47f89cd353067ffe56c3b2cc91e146236fa9e

SHA256
4e3fad6298feac58cf26bfc4fa2d0255ebaacdebafad223ad12790ca031408fc

SHA512
3129a0be0252626ac8794540860c28324f7f9485e146d54615206e7f8a7d2c8b3f01a44c60c5af96a092763b7db68a41489d2cfef926ef9eb8e82fb41aacc582

Download Submit
C:\Users\Admin\AppData\Local\Temp\D47B.exe

Filesize
1.1MB

MD5
c8beb87469647c6fb577d2bfec8e0fcd

SHA1
dcbbd759d34cb4d23c53d67943c47a250ee32767

SHA256
c0ada9e11f5005b3b81f34b522c43ef087fb77e1444bfe902bcaf6dfad22e8c6

SHA512
678bbc9fcaa886d4babf499303afdbdf737d0e98d830bc404bcd74255742595229fa99c757f2b6c90b729b3fe260faecd2928405aaa641d774fda96fd80870fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\D47B.exe

Filesize
1.1MB

MD5
c8beb87469647c6fb577d2bfec8e0fcd

SHA1
dcbbd759d34cb4d23c53d67943c47a250ee32767

SHA256
c0ada9e11f5005b3b81f34b522c43ef087fb77e1444bfe902bcaf6dfad22e8c6

SHA512
678bbc9fcaa886d4babf499303afdbdf737d0e98d830bc404bcd74255742595229fa99c757f2b6c90b729b3fe260faecd2928405aaa641d774fda96fd80870fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\FD71.exe

Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
C:\Users\Admin\AppData\Local\Temp\FD71.exe

Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

Filesize
797KB

MD5
24925b25552a7d8f1d3292071e545920

SHA1
f786e1d40df30f6fed0301d60c823b655f2d6eac

SHA256
9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

SHA512
242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

Filesize
797KB

MD5
24925b25552a7d8f1d3292071e545920

SHA1
f786e1d40df30f6fed0301d60c823b655f2d6eac

SHA256
9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

SHA512
242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

Download Submit
\??\c:\program files (x86)\windowspowershell\modules\export.dll

Filesize
797KB

MD5
7b8c425b26102b03c7b986a6b7db4038

SHA1
c3db052baeb3436a1f822893692ec266935f3ac6

SHA256
83fb67f2ab79ab94e5af6a2b0cedee216ae20f4c8bd29d3df72730225061bbdd

SHA512
a0c5d9b051601a1ccbe8c2a706415eb7bb222aa6407e5fb3a23fd87592ec64f94ecfc80de9290d13a9b6253b0040a86419292d003b020d3d67180b0317dc47dc

Download Submit
memory/176-161-0x0000000005CC0000-0x0000000005E00000-memory.dmp

Filesize
1.2MB

Download
memory/176-151-0x00000000053B0000-0x0000000005AD5000-memory.dmp

Filesize
7.1MB

Download
memory/176-159-0x0000000005CC0000-0x0000000005E00000-memory.dmp

Filesize
1.2MB

Download
memory/176-154-0x0000000005CC0000-0x0000000005E00000-memory.dmp

Filesize
1.2MB

Download
memory/176-170-0x00000000053B0000-0x0000000005AD5000-memory.dmp

Filesize
7.1MB

Download
memory/176-139-0x0000000000000000-mapping.dmp

Download
memory/176-167-0x0000000005D39000-0x0000000005D3B000-memory.dmp

Filesize
8KB

Download
memory/176-163-0x0000000005CC0000-0x0000000005E00000-memory.dmp

Filesize
1.2MB

Download
memory/176-153-0x0000000005CC0000-0x0000000005E00000-memory.dmp

Filesize
1.2MB

Download
memory/176-152-0x00000000053B0000-0x0000000005AD5000-memory.dmp

Filesize
7.1MB

Download
memory/176-162-0x0000000005CC0000-0x0000000005E00000-memory.dmp

Filesize
1.2MB

Download
memory/176-160-0x0000000005D39000-0x0000000005D3B000-memory.dmp

Filesize
8KB

Download
memory/696-158-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/696-157-0x0000000000682000-0x0000000000693000-memory.dmp

Filesize
68KB

Download
memory/2220-135-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2220-134-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2220-133-0x0000000002190000-0x0000000002199000-memory.dmp

Filesize
36KB

Download
memory/2220-132-0x0000000000668000-0x000000000067E000-memory.dmp

Filesize
88KB

Download
memory/2928-176-0x0000000003250000-0x0000000003975000-memory.dmp

Filesize
7.1MB

Download
memory/3164-145-0x0000000000000000-mapping.dmp

Download
memory/3164-150-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3164-172-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3164-148-0x00000000006F9000-0x0000000000709000-memory.dmp

Filesize
64KB

Download
memory/3164-171-0x00000000006F9000-0x0000000000709000-memory.dmp

Filesize
64KB

Download
memory/3164-149-0x00000000005A0000-0x00000000005A9000-memory.dmp

Filesize
36KB

Download
memory/3756-168-0x0000000000A40000-0x0000000000C59000-memory.dmp

Filesize
2.1MB

Download
memory/3756-164-0x00007FF6A40C6890-mapping.dmp

Download
memory/3756-165-0x00000195F6760000-0x00000195F68A0000-memory.dmp

Filesize
1.2MB

Download
memory/3756-166-0x00000195F6760000-0x00000195F68A0000-memory.dmp

Filesize
1.2MB

Download
memory/3756-169-0x00000195F4D90000-0x00000195F4FBA000-memory.dmp

Filesize
2.2MB

Download
memory/4112-144-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/4112-143-0x0000000002340000-0x0000000002470000-memory.dmp

Filesize
1.2MB

Download
memory/4112-142-0x0000000002246000-0x0000000002335000-memory.dmp

Filesize
956KB

Download
memory/4112-136-0x0000000000000000-mapping.dmp

Download