Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2022, 12:30

General

  • Target

    f6e7473ec1d725f3f0b05f071f26355d86a480a29f6044f5dfe3210977f286aa.exe

  • Size

    1.1MB

  • MD5

    11bccba197c0008c8d2635448a14541b

  • SHA1

    3d7792942e6900117547d03d6ccbeac3852e1f45

  • SHA256

    f6e7473ec1d725f3f0b05f071f26355d86a480a29f6044f5dfe3210977f286aa

  • SHA512

    5f7f0457c7b3d21322db66af1038187d91b3a300b6caa72dc2f3562c0c09dd0de67af6ce974b1c8471a03fed30936d026ac1ea4e253c9a16205edd603b936a8e

  • SSDEEP

    24576:7VKLpFDKsSTljEZyFfuq1OI8l1+SwFxSYhDkerKzQq/:7VUHSxQYEq1O13wFxSYhItP

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 4 IoCs
  • Sets DLL path for service in the registry 2 TTPs 2 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 38 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6e7473ec1d725f3f0b05f071f26355d86a480a29f6044f5dfe3210977f286aa.exe
    "C:\Users\Admin\AppData\Local\Temp\f6e7473ec1d725f3f0b05f071f26355d86a480a29f6044f5dfe3210977f286aa.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:1916
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14124
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1880
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:1316
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:2492
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 472
          2⤵
          • Program crash
          PID:2236
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2912 -ip 2912
        1⤵
          PID:4172
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:2680
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\SysWOW64\svchost.exe -k LocalService
            1⤵
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2104
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\acrobat_parcel_generic_32.dll",hmIkNEw2QTY=
              2⤵
              • Loads dropped DLL
              • Checks processor information in registry
              PID:1360

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\WindowsPowerShell\Modules\acrobat_parcel_generic_32.dll

            Filesize

            797KB

            MD5

            27ad2e09e7fb67aeb3f0a177eacee5bf

            SHA1

            632ba1684b6bda253915c77bc6dc7428b6386feb

            SHA256

            d2fec46d1e80bd292d599da77ab32e31978809a2fe90607baca1ee9b2a7811d3

            SHA512

            d114cd91dad0ab93b528c3529ef5004ba6dfe34caa1056dda642a3ac1747fc401490546a8e84d66c31c0b4e32cb410db0117288c4560fed6182955455c24e2ce

          • C:\Program Files (x86)\WindowsPowerShell\Modules\acrobat_parcel_generic_32.dll

            Filesize

            797KB

            MD5

            27ad2e09e7fb67aeb3f0a177eacee5bf

            SHA1

            632ba1684b6bda253915c77bc6dc7428b6386feb

            SHA256

            d2fec46d1e80bd292d599da77ab32e31978809a2fe90607baca1ee9b2a7811d3

            SHA512

            d114cd91dad0ab93b528c3529ef5004ba6dfe34caa1056dda642a3ac1747fc401490546a8e84d66c31c0b4e32cb410db0117288c4560fed6182955455c24e2ce

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\C2RManifest.office32ww.msi.16.x-none.xml

            Filesize

            331KB

            MD5

            b5cf5d15a8e6c6f2eb99a5645a2c2336

            SHA1

            7efe1b634ce1253a6761eb0c54f79dd42b79325f

            SHA256

            f3b3a6d7eafd8952d6c56b76d084cbc2617407b80e406488ca4961d4e905f38c

            SHA512

            83f15e9930ea058f8d3d7fe7eac40d85416204b65d7ce0e5b82057bc03f537d84c3c54ec6cc22b530f87a9c7d7d60742bd7bbe749d01454d9fcc32f6f99d32cf

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

            Filesize

            2.3MB

            MD5

            7f7a57cdda3a793223eddb107acd3e40

            SHA1

            9d70b2e4ad0c07ab5e1ce5eaa896fdaea4bee467

            SHA256

            1b5d2585fdddcbe2216e1b96a17ae0decca911b6e37e951f13131cda3b984004

            SHA512

            ef8669adc775284392618e23f7e09c6b7d905544f2e13ee62c2fab6f036a84adbf0636d2c277e1f954c12c534422d3860ecf673dc29b1e50099d6d51cdf94078

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

            Filesize

            2.3MB

            MD5

            1d9c8b9cdd2c40a2b6b3e10bab641d8b

            SHA1

            73665a873c1d54b9a5660f6d8a086d0f6c9075cd

            SHA256

            547edf5e6d7bd9a1ed64c342b6612ebc604e80cb30bd0f675247ae62d0e59c3e

            SHA512

            fc305d2628cc31c9c6c1cc99185110db0c1be63524b920c900c81c81f44de24702dc50434beb43333b5b85a048146bd9db8ee21744970b1f885689a9e3719b01

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe.xml

            Filesize

            26KB

            MD5

            2bc8ee174a90308d275eda81bf42d95e

            SHA1

            284647d3ee515e4794d1984d2f01989f33121d2d

            SHA256

            d8bd4c83debd08b1a21d24b3c4a445512ef1931717c01e113fbfc20f47157ea8

            SHA512

            fe5d552cbfea372817d64c69f22cbf1a02d1b7ef27ef4a0acf68247a2794f58d09b0147ef110a0267bda87c6712ba18dc261a8c9c7e3ed4c1352bb324ed42327

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c.xml

            Filesize

            862B

            MD5

            c017cbd831d5fe3da5d63535c0a7cac9

            SHA1

            4266aab95f2a6988bf07637bf9591bb363f542b5

            SHA256

            ad263ad6a68bc9376a151f62188941748b467f82e9638fdfd937047e289edf6a

            SHA512

            f96a087201821c6299acb8d1e428a4d58ff9d31a1c5d9f20d24ff1e9e9e97aacdb31ca818d6c53caa0d7da4b3a48a54cf2a39259ed2d362f9aa082c065d6c40c

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\edbres00001.jrs

            Filesize

            64KB

            MD5

            fcd6bcb56c1689fcef28b57c22475bad

            SHA1

            1adc95bebe9eea8c112d40cd04ab7a8d75c4f961

            SHA256

            de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31

            SHA512

            73e4153936dab198397b74ee9efc26093dda721eaab2f8d92786891153b45b04265a161b169c988edb0db2c53124607b6eaaa816559c5ce54f3dbc9fa6a7a4b2

          • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\scan_property.ico

            Filesize

            65KB

            MD5

            a348f66a6427a599596849f4256a5b8d

            SHA1

            1edc7072a3cdaaa191065ce17855e6a596cfe6de

            SHA256

            7e2789e022e43c931114d6a712e0ddeaa925975e08a77e3c403cd705c3b819e8

            SHA512

            2a564e12977ab9fc745563626e53eb882d0d3ed2c1c70eda231a9630066fb4d43a85ab919678faaf8e19252e2b93da1f2e43aad0768e46b9ec5587dadb26ea24

          • C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

            Filesize

            797KB

            MD5

            24925b25552a7d8f1d3292071e545920

            SHA1

            f786e1d40df30f6fed0301d60c823b655f2d6eac

            SHA256

            9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

            SHA512

            242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

          • C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

            Filesize

            797KB

            MD5

            24925b25552a7d8f1d3292071e545920

            SHA1

            f786e1d40df30f6fed0301d60c823b655f2d6eac

            SHA256

            9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

            SHA512

            242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

          • \??\c:\program files (x86)\windowspowershell\modules\acrobat_parcel_generic_32.dll

            Filesize

            797KB

            MD5

            27ad2e09e7fb67aeb3f0a177eacee5bf

            SHA1

            632ba1684b6bda253915c77bc6dc7428b6386feb

            SHA256

            d2fec46d1e80bd292d599da77ab32e31978809a2fe90607baca1ee9b2a7811d3

            SHA512

            d114cd91dad0ab93b528c3529ef5004ba6dfe34caa1056dda642a3ac1747fc401490546a8e84d66c31c0b4e32cb410db0117288c4560fed6182955455c24e2ce

          • memory/1360-167-0x0000000003E10000-0x0000000004535000-memory.dmp

            Filesize

            7.1MB

          • memory/1360-168-0x0000000003E10000-0x0000000004535000-memory.dmp

            Filesize

            7.1MB

          • memory/1360-172-0x0000000003E10000-0x0000000004535000-memory.dmp

            Filesize

            7.1MB

          • memory/1880-152-0x000001A6F1D80000-0x000001A6F1FAA000-memory.dmp

            Filesize

            2.2MB

          • memory/1880-150-0x000001A6F1C00000-0x000001A6F1D40000-memory.dmp

            Filesize

            1.2MB

          • memory/1880-151-0x0000000000960000-0x0000000000B79000-memory.dmp

            Filesize

            2.1MB

          • memory/1880-149-0x000001A6F1C00000-0x000001A6F1D40000-memory.dmp

            Filesize

            1.2MB

          • memory/1916-146-0x0000000006360000-0x00000000064A0000-memory.dmp

            Filesize

            1.2MB

          • memory/1916-141-0x0000000006360000-0x00000000064A0000-memory.dmp

            Filesize

            1.2MB

          • memory/1916-145-0x0000000006360000-0x00000000064A0000-memory.dmp

            Filesize

            1.2MB

          • memory/1916-139-0x00000000054F0000-0x0000000005C15000-memory.dmp

            Filesize

            7.1MB

          • memory/1916-153-0x00000000054F0000-0x0000000005C15000-memory.dmp

            Filesize

            7.1MB

          • memory/1916-148-0x00000000063D9000-0x00000000063DB000-memory.dmp

            Filesize

            8KB

          • memory/1916-144-0x0000000006360000-0x00000000064A0000-memory.dmp

            Filesize

            1.2MB

          • memory/1916-143-0x0000000006360000-0x00000000064A0000-memory.dmp

            Filesize

            1.2MB

          • memory/1916-142-0x0000000006360000-0x00000000064A0000-memory.dmp

            Filesize

            1.2MB

          • memory/1916-140-0x00000000054F0000-0x0000000005C15000-memory.dmp

            Filesize

            7.1MB

          • memory/2104-158-0x0000000003FB0000-0x00000000046D5000-memory.dmp

            Filesize

            7.1MB

          • memory/2104-171-0x0000000003FB0000-0x00000000046D5000-memory.dmp

            Filesize

            7.1MB

          • memory/2104-157-0x0000000003FB0000-0x00000000046D5000-memory.dmp

            Filesize

            7.1MB

          • memory/2912-132-0x000000000234E000-0x000000000243D000-memory.dmp

            Filesize

            956KB

          • memory/2912-134-0x0000000000400000-0x000000000053E000-memory.dmp

            Filesize

            1.2MB

          • memory/2912-138-0x0000000000400000-0x000000000053E000-memory.dmp

            Filesize

            1.2MB

          • memory/2912-133-0x0000000002440000-0x0000000002570000-memory.dmp

            Filesize

            1.2MB