Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2022, 10:30

General

  • Target

    4162582a729874d7ae84b69bb265fcc1a26ef2635de322bc60c18db397f20912.exe

  • Size

    1.1MB

  • MD5

    be1369ec379e0ec8dd84be3d5a26ac00

  • SHA1

    ee6832ff5c366b22291778d8c314f0d4ec6b1225

  • SHA256

    4162582a729874d7ae84b69bb265fcc1a26ef2635de322bc60c18db397f20912

  • SHA512

    4b1546ac4017772a97d5c16be5be988ce31f64161a4df2ed39d4fcab6590616f8268f8cc3d193a9b50c0ebecf7505a445554a5897dd5ff29f1eda6437194b171

  • SSDEEP

    24576:TuVphQcMt0PVCry56Ck+ghSeqNXT2v1fxOdmpCWYLkur4+g:TCpTBsNCMfZ1fgdZwX

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 4 IoCs
  • Sets DLL path for service in the registry 2 TTPs 3 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 39 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4162582a729874d7ae84b69bb265fcc1a26ef2635de322bc60c18db397f20912.exe
    "C:\Users\Admin\AppData\Local\Temp\4162582a729874d7ae84b69bb265fcc1a26ef2635de322bc60c18db397f20912.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:736
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14124
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:4052
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:4736
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:4600
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 528
          2⤵
          • Program crash
          PID:2280
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2124 -ip 2124
        1⤵
          PID:5116
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:1296
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\SysWOW64\svchost.exe -k LocalService
            1⤵
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4652
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\certificates_r..dll",rWFMT3AyQg==
              2⤵
              • Loads dropped DLL
              • Checks processor information in registry
              PID:4348

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\WindowsPowerShell\Modules\Certificates_R..dll

            Filesize

            797KB

            MD5

            63fdacce53633c0023a65b9557f837b4

            SHA1

            6475a5b1050166bbaa40e4ea665093da32b46073

            SHA256

            702a7269c90cec81ff1c548109e4b3274463c9d58940c88e1bb63c933f13c003

            SHA512

            878cb01b7433dfe579dfee9146754fa4bdbdd72e7ba0dcb883ede588dd8fe73aeffbc16ca46e227b62489363328c3c03f39ccad7123fa33db725d6a311236549

          • C:\Program Files (x86)\WindowsPowerShell\Modules\Certificates_R..dll

            Filesize

            797KB

            MD5

            63fdacce53633c0023a65b9557f837b4

            SHA1

            6475a5b1050166bbaa40e4ea665093da32b46073

            SHA256

            702a7269c90cec81ff1c548109e4b3274463c9d58940c88e1bb63c933f13c003

            SHA512

            878cb01b7433dfe579dfee9146754fa4bdbdd72e7ba0dcb883ede588dd8fe73aeffbc16ca46e227b62489363328c3c03f39ccad7123fa33db725d6a311236549

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

            Filesize

            2.3MB

            MD5

            945f0c08be6f3fca2469775218ca24ee

            SHA1

            1c7ebb81f10582b539a80db91042ebe9c57697f9

            SHA256

            10964c29f39f6cc0745b737fcf1a41298b93b3ea15cbadf80a26bd63486e7f46

            SHA512

            1937b18659657b38edc7c12ac374b491f1448daf9c24e204a64acfb61d53748aacc1e592c890920f66a048a51a2250c84d3d2527ffddf27b27b28eef3b8f40ad

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

            Filesize

            2.3MB

            MD5

            945f0c08be6f3fca2469775218ca24ee

            SHA1

            1c7ebb81f10582b539a80db91042ebe9c57697f9

            SHA256

            10964c29f39f6cc0745b737fcf1a41298b93b3ea15cbadf80a26bd63486e7f46

            SHA512

            1937b18659657b38edc7c12ac374b491f1448daf9c24e204a64acfb61d53748aacc1e592c890920f66a048a51a2250c84d3d2527ffddf27b27b28eef3b8f40ad

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.AsyncTextService_10.0.19041.1023_neutral__8wekyb3d8bbwe.xml

            Filesize

            2KB

            MD5

            2240070d6603ab019cd125005cf38b7b

            SHA1

            ca96d028f51a7d5ec16630b48935f26c72794b0a

            SHA256

            7b3b1b641ebbda5397a11af86cb347b0f644ab439341c62b1c81d6990e6f75bc

            SHA512

            95c6f48f717d9103d30c31e00b7ff3a0d235693a8fffed772c0a0c39107bf3003ac84d6c78e2af566d91a88fa523dcc2c523dcc707d19fc77799832d548f330c

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe.xml

            Filesize

            16KB

            MD5

            4194b927b32c56bb3a5ed72c164c917e

            SHA1

            ec60c6bb8b2d0181408c65b3456b7b3b92cca134

            SHA256

            86d065b6d87309122e9fce9b960f5d56a45dfcdd83122a4225ed9fd3136320d8

            SHA512

            c94baa6f849bb048e572667e19268754efc58bce6673373db9817c729b36acbfd0bb30975a441f2a5cd16e00be97db412dd82f1669c1701004a1e27307f75c1d

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe.xml

            Filesize

            5KB

            MD5

            1944801cae061223e36fcce6aed6bfba

            SHA1

            b465c53f3e6ae74fac368f36cbfc5842ce085e14

            SHA256

            b903a7f4408a27d0b7a7c6316d04952508d67058216dffeca4293c9352727959

            SHA512

            82b0e3b1105a5d802839c3ea78b4e2dd800b819ee678d016b2f47203ceb27a638d195909ec1d0efbf46edbf910409d7ab4a05146fc902ef335b36bf14339498f

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe.xml

            Filesize

            6KB

            MD5

            7e913c1a399dd176eea1bb8f2be26268

            SHA1

            6be9a44820ffbabb10202af890da00c9aa2dfec2

            SHA256

            5295393602a18f301613c7160e24f88816070a41cf69b32c821b6d3858541b4a

            SHA512

            dc52de8489f586081c246a297a35987eb7f74e122f475df88cfdc683787fe532e609db3b43915c73f7f172e1a4fc13efacd1b52252d1041e5c8f4dd190009105

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe.xml

            Filesize

            827B

            MD5

            ded8a0ae2ade3e3cab8bfbfea00b969f

            SHA1

            73752c78795a78ef3b742ad41737959e6f51ee42

            SHA256

            ffc4b3afeec6909f2b6e167d903c624448bb8b5e3540142a0a762953dc758c85

            SHA512

            3c687dd555e18bfc59bc544bcaae9f27d7eae55aae62c8f6517e263052f72d1679b097cc02faa6514a3a03619b23910ba78af3b3955cf3fe79d2c1f7e8aca72a

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\MicrosoftOffice2013BackupWin64.xml

            Filesize

            12KB

            MD5

            d24bea7d3b999f28e375d1d061a03d97

            SHA1

            95b207708762aa4752c77728128cbe3033646204

            SHA256

            57184b71b7d7525fbd75b1dda77bd26a5344b5cbd58ec5070fa5e1b4e073aef2

            SHA512

            3d3f06cd59a5bf8e9284ed1972a373ac1c63b0cba997d9559834db748ec41a90e42650d0ba05bf351456c2de12970f79d2d34f7a6c6445d2e55812682a5b406e

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Policy.vpol

            Filesize

            444B

            MD5

            06a26bd9a786dfd815b92d9f149ac770

            SHA1

            c5532598867b39bc635399b7845691a04209abb2

            SHA256

            cf0120016fbb22ffae5cdc3e3995c4b5908d09c0fa759058abfd0cdba04d18c9

            SHA512

            b856b25525f39f2c3d99e7e954e672ce732408a37f5ea0f85099a30808917b6dd0e046b7a3e29a08f949bc6bab7b05f9182c9620db5f40f210fe5d64d296c5e5

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\resource.xml

            Filesize

            1KB

            MD5

            36b733e882d091355ffdd2b0a3286888

            SHA1

            0043a974ebd90d802e8cc5e04b5cefc980d03292

            SHA256

            f83662badfaa62797f925aa8292852be5351d3e641d70fe22c911ee4cdf68aad

            SHA512

            abb0df60401f74df3368e17cd8ff672dceaeef0fbeb097da659c07f2b8d756a09ada065ecb3ba7ccabbb4416817d730c13e6340ae5c6239dff31ae8b81c0a10c

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\setup.exe

            Filesize

            453KB

            MD5

            96f7cb9f7481a279bd4bc0681a3b993e

            SHA1

            deaedb5becc6c0bd263d7cf81e0909b912a1afd4

            SHA256

            d2893c55259772b554cb887d3e2e1f9c67f5cd5abac2ab9f4720dec507cdd290

            SHA512

            694d2da36df04db25cc5972f7cc180b77e1cb0c3b5be8b69fe7e2d4e59555efb8aa7e50b1475ad5196ca638dabde2c796ae6faeb4a31f38166838cd1cc028149

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\watermark.png

            Filesize

            28KB

            MD5

            1f93b502e78190a2f496c2d9558e069d

            SHA1

            6ae6249493d36682270c0d5e3eb3c472fdd2766e

            SHA256

            5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e

            SHA512

            cf07724c203a82c9f202d53f63ea00ab0df2f97484bd3b9abe1a001f2e531f505ddd4ff8f2d5a2769dd9d2d60e9c1d03dd3ab5143542688f944cfd35c6f1cdf3

          • C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

            Filesize

            797KB

            MD5

            24925b25552a7d8f1d3292071e545920

            SHA1

            f786e1d40df30f6fed0301d60c823b655f2d6eac

            SHA256

            9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

            SHA512

            242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

          • C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

            Filesize

            797KB

            MD5

            24925b25552a7d8f1d3292071e545920

            SHA1

            f786e1d40df30f6fed0301d60c823b655f2d6eac

            SHA256

            9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

            SHA512

            242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

          • \??\c:\program files (x86)\windowspowershell\modules\certificates_r..dll

            Filesize

            797KB

            MD5

            63fdacce53633c0023a65b9557f837b4

            SHA1

            6475a5b1050166bbaa40e4ea665093da32b46073

            SHA256

            702a7269c90cec81ff1c548109e4b3274463c9d58940c88e1bb63c933f13c003

            SHA512

            878cb01b7433dfe579dfee9146754fa4bdbdd72e7ba0dcb883ede588dd8fe73aeffbc16ca46e227b62489363328c3c03f39ccad7123fa33db725d6a311236549

          • memory/736-149-0x0000000005569000-0x000000000556B000-memory.dmp

            Filesize

            8KB

          • memory/736-145-0x00000000054F0000-0x0000000005630000-memory.dmp

            Filesize

            1.2MB

          • memory/736-140-0x00000000054F0000-0x0000000005630000-memory.dmp

            Filesize

            1.2MB

          • memory/736-152-0x0000000004BB0000-0x00000000052D5000-memory.dmp

            Filesize

            7.1MB

          • memory/736-141-0x00000000054F0000-0x0000000005630000-memory.dmp

            Filesize

            1.2MB

          • memory/736-139-0x0000000004BB0000-0x00000000052D5000-memory.dmp

            Filesize

            7.1MB

          • memory/736-138-0x0000000004BB0000-0x00000000052D5000-memory.dmp

            Filesize

            7.1MB

          • memory/736-142-0x00000000054F0000-0x0000000005630000-memory.dmp

            Filesize

            1.2MB

          • memory/736-143-0x00000000054F0000-0x0000000005630000-memory.dmp

            Filesize

            1.2MB

          • memory/736-144-0x00000000054F0000-0x0000000005630000-memory.dmp

            Filesize

            1.2MB

          • memory/2124-136-0x0000000002440000-0x0000000002570000-memory.dmp

            Filesize

            1.2MB

          • memory/2124-135-0x0000000002341000-0x0000000002430000-memory.dmp

            Filesize

            956KB

          • memory/2124-137-0x0000000000400000-0x000000000053E000-memory.dmp

            Filesize

            1.2MB

          • memory/4052-148-0x0000027DFCBF0000-0x0000027DFCD30000-memory.dmp

            Filesize

            1.2MB

          • memory/4052-147-0x0000027DFCBF0000-0x0000027DFCD30000-memory.dmp

            Filesize

            1.2MB

          • memory/4052-150-0x0000000000E10000-0x0000000001029000-memory.dmp

            Filesize

            2.1MB

          • memory/4052-151-0x0000027DFB220000-0x0000027DFB44A000-memory.dmp

            Filesize

            2.2MB

          • memory/4348-171-0x0000000003F20000-0x0000000004645000-memory.dmp

            Filesize

            7.1MB

          • memory/4348-172-0x0000000003F20000-0x0000000004645000-memory.dmp

            Filesize

            7.1MB

          • memory/4652-156-0x0000000003940000-0x0000000004065000-memory.dmp

            Filesize

            7.1MB

          • memory/4652-170-0x0000000003940000-0x0000000004065000-memory.dmp

            Filesize

            7.1MB

          • memory/4652-175-0x0000000003940000-0x0000000004065000-memory.dmp

            Filesize

            7.1MB