Analysis

  • max time kernel
    127s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20/12/2022, 13:50

General

  • Target

    39e9581effab24da8eb08d77968c002d4d742dd836ec2a0c8ab6b9879b4892a7.exe

  • Size

    1.1MB

  • MD5

    0bcfd64236a383b6eb74c14e7852c06b

  • SHA1

    e30bf2b3338a759c1af139e681beb08b9d20db82

  • SHA256

    39e9581effab24da8eb08d77968c002d4d742dd836ec2a0c8ab6b9879b4892a7

  • SHA512

    bb75de366f834acf8f725ea7dcde4f8a38324166ea13ee6f1aee8b0599d53a194c2140894418ad9c6b169ad91e63188e0db799172daf13bc95d9cb9d3d2a759e

  • SSDEEP

    24576:kuatcRWvhEZD0sOBM++IGoEr8S4nG8VcV33AcXm:DoEZbOD+IxE89V+Z3S

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 3 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 42 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39e9581effab24da8eb08d77968c002d4d742dd836ec2a0c8ab6b9879b4892a7.exe
    "C:\Users\Admin\AppData\Local\Temp\39e9581effab24da8eb08d77968c002d4d742dd836ec2a0c8ab6b9879b4892a7.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:4680
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14138
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:4784
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:4636
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:5004
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:3120
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe -k LocalService
          1⤵
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:8
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\ini.dll",a2EK
            2⤵
            • Loads dropped DLL
            PID:2236

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\0__Power_EnergyEstimationEngine.provxml

          Filesize

          463B

          MD5

          2cf4ea4d03f8a1f424c2db46789ed2e3

          SHA1

          50bb43d2589bc86115baac9fcdfcabadeff70c6d

          SHA256

          41d62ac11f8cc15391010f53a7262df090149355b07021fe648d15c24fb45090

          SHA512

          c2dd7c30856006f8eec73402284c86ab35c9daf824f81a33aefa1502d881be0a066da75441bdba97236f6bf3586b77d9e244cc94ccfac8e28fba06c61e9b78e6

        • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\131__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml

          Filesize

          665B

          MD5

          10a8b787ad21dec6a500a119ddcad593

          SHA1

          3e519643358b158cf11ce8be5ba92a8673e2f401

          SHA256

          c860723fbaa28599dba8c909c8b2caddd38fc725f780abc81a4afed7f13d6f68

          SHA512

          ba3d813d2849718bf323ab63d1c562fc2e32472ab59f9822b3260f5a2757f24806fed193b35285e7fca94fd06b12594a498aa127d9252aa356f63c4e44cbc6f6

        • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\C2RManifest.office32ww.msi.16.x-none.xml

          Filesize

          331KB

          MD5

          b5cf5d15a8e6c6f2eb99a5645a2c2336

          SHA1

          7efe1b634ce1253a6761eb0c54f79dd42b79325f

          SHA256

          f3b3a6d7eafd8952d6c56b76d084cbc2617407b80e406488ca4961d4e905f38c

          SHA512

          83f15e9930ea058f8d3d7fe7eac40d85416204b65d7ce0e5b82057bc03f537d84c3c54ec6cc22b530f87a9c7d7d60742bd7bbe749d01454d9fcc32f6f99d32cf

        • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

          Filesize

          2.3MB

          MD5

          c1afb726245d36026dd3ca97928bc7d6

          SHA1

          73974a1a5b85e9d2798c90b40c4563fadfea576b

          SHA256

          7df47943d504e8b12f95e8b792dcc1abc5b2ac220395f1e1441ea98ad5d0853e

          SHA512

          868522331450230514c94fa852733c8f19d3b00c0c624b729e45a313ea15eb07bac60dc391c31dd280596307f0cf0859a602ebedab26e538e88c1401774a424d

        • C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\setup.ini

          Filesize

          214B

          MD5

          d8b2e1bfe12db863bdccdd49a5e1c8b5

          SHA1

          9c979907f03887b270d4e87b0cdd5377cff3692c

          SHA256

          00b5526d5cffb22eb22eb663fd3863c3f287c5bfc951f1d45cdd0cf0b25c2301

          SHA512

          3bf15a8620fa2269fb1fc7280bc203d62160f66d0cfcdc6422b0d33ab3745c6be864a8b51728f92b9e63ba3d7b1504ad8448996f14e866102369ea91b3ad7d41

        • C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

          Filesize

          797KB

          MD5

          24925b25552a7d8f1d3292071e545920

          SHA1

          f786e1d40df30f6fed0301d60c823b655f2d6eac

          SHA256

          9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

          SHA512

          242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

        • \??\c:\program files (x86)\windowspowershell\modules\ini.dll

          Filesize

          797KB

          MD5

          8ff4b4d90f83b7ccd45ab862139969d8

          SHA1

          0578182ef7af13dd42e7af5142f5c1ec279a38cd

          SHA256

          c201c035f0496ebae3a2ea765cbbb86c354294a7936029a6f00268ff93a66839

          SHA512

          2ef77189416aedbb5eca32fd0938e395a1c864217c7b70eccbb8af8231374436e7883fa5ff7822946609b17d84df07b5712ef84c2b1008514a0fa4ca689e8ae8

        • \Program Files (x86)\WindowsPowerShell\Modules\ini.dll

          Filesize

          797KB

          MD5

          8ff4b4d90f83b7ccd45ab862139969d8

          SHA1

          0578182ef7af13dd42e7af5142f5c1ec279a38cd

          SHA256

          c201c035f0496ebae3a2ea765cbbb86c354294a7936029a6f00268ff93a66839

          SHA512

          2ef77189416aedbb5eca32fd0938e395a1c864217c7b70eccbb8af8231374436e7883fa5ff7822946609b17d84df07b5712ef84c2b1008514a0fa4ca689e8ae8

        • \Program Files (x86)\WindowsPowerShell\Modules\ini.dll

          Filesize

          797KB

          MD5

          8ff4b4d90f83b7ccd45ab862139969d8

          SHA1

          0578182ef7af13dd42e7af5142f5c1ec279a38cd

          SHA256

          c201c035f0496ebae3a2ea765cbbb86c354294a7936029a6f00268ff93a66839

          SHA512

          2ef77189416aedbb5eca32fd0938e395a1c864217c7b70eccbb8af8231374436e7883fa5ff7822946609b17d84df07b5712ef84c2b1008514a0fa4ca689e8ae8

        • \Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

          Filesize

          797KB

          MD5

          24925b25552a7d8f1d3292071e545920

          SHA1

          f786e1d40df30f6fed0301d60c823b655f2d6eac

          SHA256

          9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

          SHA512

          242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

        • memory/8-417-0x0000000005DE0000-0x0000000006505000-memory.dmp

          Filesize

          7.1MB

        • memory/8-503-0x0000000005DE0000-0x0000000006505000-memory.dmp

          Filesize

          7.1MB

        • memory/2236-458-0x0000000005FF0000-0x0000000006715000-memory.dmp

          Filesize

          7.1MB

        • memory/2236-504-0x0000000005FF0000-0x0000000006715000-memory.dmp

          Filesize

          7.1MB

        • memory/4680-170-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-284-0x0000000007750000-0x0000000007E75000-memory.dmp

          Filesize

          7.1MB

        • memory/4680-281-0x0000000008639000-0x000000000863B000-memory.dmp

          Filesize

          8KB

        • memory/4680-267-0x0000000007750000-0x0000000007E75000-memory.dmp

          Filesize

          7.1MB

        • memory/4680-185-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-187-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-189-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-188-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-186-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-174-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-184-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-183-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-182-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-181-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-180-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-179-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-178-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-177-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-176-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-175-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-172-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-173-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-167-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-169-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-171-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4680-166-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-156-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-142-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-163-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-120-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-162-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-161-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-160-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-168-0x0000000000400000-0x000000000053D000-memory.dmp

          Filesize

          1.2MB

        • memory/4740-159-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-158-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-157-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-138-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-155-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-154-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-153-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-152-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-151-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-150-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-149-0x0000000000400000-0x000000000053D000-memory.dmp

          Filesize

          1.2MB

        • memory/4740-147-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-145-0x0000000002290000-0x0000000002381000-memory.dmp

          Filesize

          964KB

        • memory/4740-146-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-148-0x00000000023B0000-0x00000000024E0000-memory.dmp

          Filesize

          1.2MB

        • memory/4740-144-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-143-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-164-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-137-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-136-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-141-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-121-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-140-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-122-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-123-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-139-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-134-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-133-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-132-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-130-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-131-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-129-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-128-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-127-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-126-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-125-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4740-124-0x0000000077850000-0x00000000779DE000-memory.dmp

          Filesize

          1.6MB

        • memory/4784-283-0x00000274A38A0000-0x00000274A3ACA000-memory.dmp

          Filesize

          2.2MB

        • memory/4784-282-0x00000000005D0000-0x00000000007E9000-memory.dmp

          Filesize

          2.1MB