Analysis

  • max time kernel
    126s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    20/12/2022, 12:16

General

  • Target

    tmp.exe

  • Size

    1.1MB

  • MD5

    be1369ec379e0ec8dd84be3d5a26ac00

  • SHA1

    ee6832ff5c366b22291778d8c314f0d4ec6b1225

  • SHA256

    4162582a729874d7ae84b69bb265fcc1a26ef2635de322bc60c18db397f20912

  • SHA512

    4b1546ac4017772a97d5c16be5be988ce31f64161a4df2ed39d4fcab6590616f8268f8cc3d193a9b50c0ebecf7505a445554a5897dd5ff29f1eda6437194b171

  • SSDEEP

    24576:TuVphQcMt0PVCry56Ck+ghSeqNXT2v1fxOdmpCWYLkur4+g:TCpTBsNCMfZ1fgdZwX

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 3 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 48 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14145
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1776
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:2016
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k LocalService
      1⤵
      • Loads dropped DLL
      • Checks processor information in registry
      PID:1220
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windows sidebar\shared gadgets\usa.dll",a1IZNmJ6N1o=
        2⤵
          PID:1832

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

        Filesize

        2.3MB

        MD5

        4d5c1ae104517b4fd3fa59cf82304f13

        SHA1

        20114f1cc1f12b8ccc2175556d48aa8c4057d069

        SHA256

        2654df90386e086328e1f8d0e755fc1d3b1ac13d054f06588dd61e2161248de5

        SHA512

        7485c8577fbfcffe2746047fa9faef49aa7d6ba1ec92d5995780e1a707a596e3c4e49a52aa2f54694a065182b4c8312d65933800b0b1103fdb1fa003be2d08c9

      • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

        Filesize

        2.3MB

        MD5

        a079213c2bfcf92ceee4aeda16b66559

        SHA1

        60bce60149da716a93e7c3a6c44f9b9a4c6342c2

        SHA256

        26769fd64564cb079aeb7fbb618e0b91fa91dae2f09bf30855f04a917c0b9b13

        SHA512

        c4f597803410eba8239f4e9c08a58a2c52bbdda500bf271cdc0633b7935ef7a91911f1816794a33569876350716e34cd3a714556429ced2b756a0116356daf0d

      • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Help_CValidator.H1D

        Filesize

        11KB

        MD5

        78f3883f7874696dcd58786ee1d13bea

        SHA1

        8162c11cbe06fd3106707c3a8bbc284cb4229ab1

        SHA256

        8aa4719ed70a2f56d42a40943325093c09fc3cdd265dae176fa9e3905d7fed3d

        SHA512

        4913ed573bafcc9b4e9e8b43cbf91b18a1e2c0c9451ab1ef2a1b64f1c6f994fa17eb13f9e9885fcc1b450cd0122273f255bc6d8e8101514877ce2f217b01343b

      • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Help_MKWD_BestBet.H1W

        Filesize

        357KB

        MD5

        387339f3af4be476613ea7340c31ae7b

        SHA1

        d80990f15798aa1d70b434969b97b4af462c5a12

        SHA256

        865af03a88db2214214d53bd11efc032b0fd2ce50be3aa21e09f60b4567c1f31

        SHA512

        ea4539c3d771d41eab90d3b3904384a1075a95a1e1adcb37992206fb85bde9bfef02dbbfae311a803af0d5947aace8e9be54599b733406fb43bee649d7ff73f1

      • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\usertile17.bmp

        Filesize

        48KB

        MD5

        9afccefdd79314b5812017d7803a531c

        SHA1

        ad82364a2699b002b8d4ef0fb5a9771988923d94

        SHA256

        b633e58cd5b3239855b73f78b592283f30e0ce891c0b0373dc73e20b997e6929

        SHA512

        4ff21922fe0c40bc37ead62a0ee04e6748a5264cf172a3293c08d2df164969497ba3f351872146d43bf2f4a2992637e517c916112346439de7027adc049c3b7f

      • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\usertile31.bmp

        Filesize

        48KB

        MD5

        9be40486ad4e673aec97906a636ccb2b

        SHA1

        19130bbaf3f33098a884ae68b3e5b0e8e2789c14

        SHA256

        622d8defdd6b6abd80a45ccec629363cf38a7d338945cf1af27bdfe7d0b777b6

        SHA512

        9017b561dff451148f1f1a5da2028b2eba6162ab37dceece82b28f28269dd2bb6295d02c097f9550aa87b64841290a7cc587c6aae123168bf53efed0620172ed

      • C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

        Filesize

        797KB

        MD5

        24925b25552a7d8f1d3292071e545920

        SHA1

        f786e1d40df30f6fed0301d60c823b655f2d6eac

        SHA256

        9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

        SHA512

        242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

      • \??\c:\program files (x86)\windows sidebar\shared gadgets\usa.dll

        Filesize

        797KB

        MD5

        a00cd7e564d95456e7c677705bbbb430

        SHA1

        f843817568f09a6cab2426214e98c5111e5fefa9

        SHA256

        283faa451e9386e149f5bd4eb077a46fae2ad04ef3d4516670557fbc4220ca85

        SHA512

        2fead55cbfb9517fe6baa20e7da984f10ee0c55f77e9a3577474495a79022f4a25b316fe15869a080b07e99e64d2afc03115740f510a8324b268564c41f9f87b

      • \Program Files (x86)\Windows Sidebar\Shared Gadgets\usa.dll

        Filesize

        797KB

        MD5

        a00cd7e564d95456e7c677705bbbb430

        SHA1

        f843817568f09a6cab2426214e98c5111e5fefa9

        SHA256

        283faa451e9386e149f5bd4eb077a46fae2ad04ef3d4516670557fbc4220ca85

        SHA512

        2fead55cbfb9517fe6baa20e7da984f10ee0c55f77e9a3577474495a79022f4a25b316fe15869a080b07e99e64d2afc03115740f510a8324b268564c41f9f87b

      • \Program Files (x86)\Windows Sidebar\Shared Gadgets\usa.dll

        Filesize

        797KB

        MD5

        a00cd7e564d95456e7c677705bbbb430

        SHA1

        f843817568f09a6cab2426214e98c5111e5fefa9

        SHA256

        283faa451e9386e149f5bd4eb077a46fae2ad04ef3d4516670557fbc4220ca85

        SHA512

        2fead55cbfb9517fe6baa20e7da984f10ee0c55f77e9a3577474495a79022f4a25b316fe15869a080b07e99e64d2afc03115740f510a8324b268564c41f9f87b

      • \Program Files (x86)\Windows Sidebar\Shared Gadgets\usa.dll

        Filesize

        797KB

        MD5

        a00cd7e564d95456e7c677705bbbb430

        SHA1

        f843817568f09a6cab2426214e98c5111e5fefa9

        SHA256

        283faa451e9386e149f5bd4eb077a46fae2ad04ef3d4516670557fbc4220ca85

        SHA512

        2fead55cbfb9517fe6baa20e7da984f10ee0c55f77e9a3577474495a79022f4a25b316fe15869a080b07e99e64d2afc03115740f510a8324b268564c41f9f87b

      • \Program Files (x86)\Windows Sidebar\Shared Gadgets\usa.dll

        Filesize

        797KB

        MD5

        a00cd7e564d95456e7c677705bbbb430

        SHA1

        f843817568f09a6cab2426214e98c5111e5fefa9

        SHA256

        283faa451e9386e149f5bd4eb077a46fae2ad04ef3d4516670557fbc4220ca85

        SHA512

        2fead55cbfb9517fe6baa20e7da984f10ee0c55f77e9a3577474495a79022f4a25b316fe15869a080b07e99e64d2afc03115740f510a8324b268564c41f9f87b

      • \Program Files (x86)\Windows Sidebar\Shared Gadgets\usa.dll

        Filesize

        797KB

        MD5

        a00cd7e564d95456e7c677705bbbb430

        SHA1

        f843817568f09a6cab2426214e98c5111e5fefa9

        SHA256

        283faa451e9386e149f5bd4eb077a46fae2ad04ef3d4516670557fbc4220ca85

        SHA512

        2fead55cbfb9517fe6baa20e7da984f10ee0c55f77e9a3577474495a79022f4a25b316fe15869a080b07e99e64d2afc03115740f510a8324b268564c41f9f87b

      • \Program Files\Mozilla Firefox\firefox.exe

        Filesize

        562KB

        MD5

        d388df6ed5ccbf1acdeda5af2d18cb0b

        SHA1

        124d3c2ba93644ac6c2d7253de242b46be836692

        SHA256

        8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

        SHA512

        f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

      • \Program Files\Mozilla Firefox\firefox.exe

        Filesize

        562KB

        MD5

        d388df6ed5ccbf1acdeda5af2d18cb0b

        SHA1

        124d3c2ba93644ac6c2d7253de242b46be836692

        SHA256

        8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

        SHA512

        f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

      • \Program Files\Mozilla Firefox\firefox.exe

        Filesize

        562KB

        MD5

        d388df6ed5ccbf1acdeda5af2d18cb0b

        SHA1

        124d3c2ba93644ac6c2d7253de242b46be836692

        SHA256

        8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

        SHA512

        f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

      • \Program Files\Mozilla Firefox\firefox.exe

        Filesize

        562KB

        MD5

        d388df6ed5ccbf1acdeda5af2d18cb0b

        SHA1

        124d3c2ba93644ac6c2d7253de242b46be836692

        SHA256

        8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606

        SHA512

        f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

      • \Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

        Filesize

        797KB

        MD5

        24925b25552a7d8f1d3292071e545920

        SHA1

        f786e1d40df30f6fed0301d60c823b655f2d6eac

        SHA256

        9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

        SHA512

        242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

      • memory/1100-67-0x0000000004420000-0x0000000004560000-memory.dmp

        Filesize

        1.2MB

      • memory/1100-82-0x00000000048C0000-0x0000000004FE5000-memory.dmp

        Filesize

        7.1MB

      • memory/1100-73-0x0000000004420000-0x0000000004560000-memory.dmp

        Filesize

        1.2MB

      • memory/1100-74-0x0000000004420000-0x0000000004560000-memory.dmp

        Filesize

        1.2MB

      • memory/1100-72-0x0000000004420000-0x0000000004560000-memory.dmp

        Filesize

        1.2MB

      • memory/1100-69-0x0000000004420000-0x0000000004560000-memory.dmp

        Filesize

        1.2MB

      • memory/1100-63-0x00000000048C0000-0x0000000004FE5000-memory.dmp

        Filesize

        7.1MB

      • memory/1100-68-0x0000000004420000-0x0000000004560000-memory.dmp

        Filesize

        1.2MB

      • memory/1100-66-0x00000000048C0000-0x0000000004FE5000-memory.dmp

        Filesize

        7.1MB

      • memory/1100-65-0x00000000048C0000-0x0000000004FE5000-memory.dmp

        Filesize

        7.1MB

      • memory/1220-87-0x0000000003BA0000-0x00000000042C5000-memory.dmp

        Filesize

        7.1MB

      • memory/1220-89-0x0000000003BA0000-0x00000000042C5000-memory.dmp

        Filesize

        7.1MB

      • memory/1220-109-0x0000000003BA0000-0x00000000042C5000-memory.dmp

        Filesize

        7.1MB

      • memory/1220-100-0x0000000003BA0000-0x00000000042C5000-memory.dmp

        Filesize

        7.1MB

      • memory/1776-79-0x0000000002040000-0x000000000226A000-memory.dmp

        Filesize

        2.2MB

      • memory/1776-78-0x0000000000120000-0x0000000000339000-memory.dmp

        Filesize

        2.1MB

      • memory/1776-70-0x0000000000120000-0x0000000000339000-memory.dmp

        Filesize

        2.1MB

      • memory/1776-77-0x0000000002270000-0x00000000023B0000-memory.dmp

        Filesize

        1.2MB

      • memory/1776-76-0x0000000002270000-0x00000000023B0000-memory.dmp

        Filesize

        1.2MB

      • memory/1776-81-0x0000000002040000-0x000000000226A000-memory.dmp

        Filesize

        2.2MB

      • memory/1776-80-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

        Filesize

        8KB

      • memory/1832-102-0x0000000003B10000-0x0000000004235000-memory.dmp

        Filesize

        7.1MB

      • memory/1832-105-0x0000000003B10000-0x0000000004235000-memory.dmp

        Filesize

        7.1MB

      • memory/1832-104-0x0000000003B10000-0x0000000004235000-memory.dmp

        Filesize

        7.1MB

      • memory/1832-106-0x0000000003B10000-0x0000000004235000-memory.dmp

        Filesize

        7.1MB

      • memory/2044-59-0x0000000001E80000-0x0000000001FB0000-memory.dmp

        Filesize

        1.2MB

      • memory/2044-55-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

        Filesize

        8KB

      • memory/2044-54-0x00000000007A0000-0x000000000088F000-memory.dmp

        Filesize

        956KB

      • memory/2044-60-0x0000000000400000-0x000000000053E000-memory.dmp

        Filesize

        1.2MB

      • memory/2044-57-0x00000000007A0000-0x000000000088F000-memory.dmp

        Filesize

        956KB