Analysis

  • max time kernel
    127s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20/12/2022, 14:30

Errors

Reason
Machine shutdown

General

  • Target

    c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628.dll

  • Size

    2.4MB

  • MD5

    3b8bdfd2524da789d5611e1877c89f5d

  • SHA1

    e6b3400bfed1e2d367b78e9bfe5188401eb742f6

  • SHA256

    c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628

  • SHA512

    f779fc56f058b03f003901f454e4160b18cf88753face31f3c1401511e997e4f4b4f5ca4a74f7759bb74a1f3fa6c974af1bee76df55ace747f5022ecbf341dde

  • SSDEEP

    49152:zrqVHNsAsWe8AdaSTBfA3XGGuGATN8LxZ:zaPenfA32r8Lz

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 3 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 24 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:1852
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 20209
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1480
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k LocalService
    1⤵
    • Loads dropped DLL
    PID:1036

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Character Map.lnk

    Filesize

    1KB

    MD5

    3fdf384789965b672fce2fd5d1fbe1d3

    SHA1

    f77691e9490c41d1bed43f516ed31afb5ad0ccc9

    SHA256

    235feb312f7b00d9cb04aec2e26cd2e65dccf3ad9e8f8c49e73326d7480477e0

    SHA512

    0e459af6b8c2dfc7e10b0b0d7c7eb7aa67eb7d0e9a7bbf80ea65bc9ab8f62b8b6f527ed15f81d373054575600b16ac78c19d1c46af44badaabf21de15b2d7d36

  • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Daowpeywwstdp.tmp

    Filesize

    2.3MB

    MD5

    4fe2d16e65f0219e9c44bae797634fc3

    SHA1

    314484cc0db5527a4b127a39d0f09df307bc815d

    SHA256

    6fef448647b6ac57e2d1fbf230e1dd9f5aeb6775293b737d97366950ab446d09

    SHA512

    d80981a69fb0aa3758ea591004dcc4f5ca25fef551cef2e5b794ff8fa2cd24037fc99f7ca335cbcf7ce9eafe1a56190f252af8d4199e138739712369d3987cac

  • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\GRINTL32.DLL.trx_dll

    Filesize

    46KB

    MD5

    c8c28478cdf173e8743f51a3435851cf

    SHA1

    aef15f0a21b3f3ed49614108d7c6b4514c185157

    SHA256

    aed69f76f184a4e287a136b4f5f4d2be1343b324c6f28a99f460593952164a6d

    SHA512

    57c11e345608b830e5f14e5cd5d1188b7883fafc089a6f93ffcfc121a4ab752fe94e0d6c97b5bf6e060009cdd8ed7e89fdfb75dc1cf05a8223b03a0bc73e4e6d

  • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Help_MTOC_help.H1H

    Filesize

    531KB

    MD5

    d08f5887bbd05d85fc0ddedb103fbbfa

    SHA1

    7c1948e47afb8ba8611280d130c340757bbc8bef

    SHA256

    859373e8a8ee2d5f81b8a375bda2eb622b4c9d27302615836ba493df6b86afab

    SHA512

    8cebf1d76454777e9557659493a233b183adf311df93632302db88aa0f92b89ceb465c0228039ea9227114154872926ac7cf2e510c5992f19dfa36b2a5707a5a

  • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\usertile16.bmp

    Filesize

    48KB

    MD5

    d342c2b5f3d16dc992db22cb737ad617

    SHA1

    615a98744fb22809454b706174597a4d6b6d128b

    SHA256

    0618d6fc5a05288bb126eb258fccfe7697e194022a57206671a172a39bc5e486

    SHA512

    4f773f0cb331d46e54f89db7af96be8cd72689cd85d6698d9737052ca088c30e9bc4064cefc277ab7b65b76787735956702f6c7b8f048cabe46c2117107953d7

  • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\usertile38.bmp

    Filesize

    48KB

    MD5

    4e5c3e1452d39fb8742ce676a5033456

    SHA1

    fe6df7a297d5697cbce86a110d53f604da85db94

    SHA256

    bad04b1a9e50673c4f79fef48d129e474be08b367291ad738f0988ac58631a7a

    SHA512

    3263f77fa90239f2a7f17afb1a9b88fe6df1e33ee247e95b5f6ba4a962eaf780b148dc0d911f1c7a8eb71dcf540405c494636a084ec8be794b86bb70c4bdcec9

  • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db

    Filesize

    405KB

    MD5

    0b497eb3695e9d4935fc1cde58f8dd01

    SHA1

    b5441bfc6fb21343e07fa5c4f46292e3a1014ecb

    SHA256

    79fdd0f3657d019594518df8e077daecb1861341039ab55d3775c8b8db729793

    SHA512

    2a20010c3dd74f29ea8b7fdd302d1b3abde020c93a585d38858c8e08e83a50724f6d62e6ff6e45914003f966923d23b0a55964824c685c879773d62548957d44

  • \??\c:\program files (x86)\microsoft sync framework\v1.0\main.dll

    Filesize

    2.4MB

    MD5

    cfa4bbfed587aafe14ed013bfec53acc

    SHA1

    92515ac4d124fe70f86c9298941ebaa4fd2efedd

    SHA256

    6240ce38131d8e010628849e53f9e0088791005ee75b896ec59e3053cfca2475

    SHA512

    2419a18da3779743988660609b619cb7fe89586482226053f28f8c8cfc4eabb93116478d2e86436189c4572761bc38bf5294c5f03a063c8b27fd74c719e9e830

  • \Program Files (x86)\Microsoft Sync Framework\v1.0\main.dll

    Filesize

    2.4MB

    MD5

    cfa4bbfed587aafe14ed013bfec53acc

    SHA1

    92515ac4d124fe70f86c9298941ebaa4fd2efedd

    SHA256

    6240ce38131d8e010628849e53f9e0088791005ee75b896ec59e3053cfca2475

    SHA512

    2419a18da3779743988660609b619cb7fe89586482226053f28f8c8cfc4eabb93116478d2e86436189c4572761bc38bf5294c5f03a063c8b27fd74c719e9e830

  • memory/1036-83-0x0000000002190000-0x0000000002401000-memory.dmp

    Filesize

    2.4MB

  • memory/1036-81-0x0000000002190000-0x0000000002401000-memory.dmp

    Filesize

    2.4MB

  • memory/1036-91-0x0000000002730000-0x0000000002E55000-memory.dmp

    Filesize

    7.1MB

  • memory/1480-67-0x0000000000230000-0x0000000000449000-memory.dmp

    Filesize

    2.1MB

  • memory/1480-75-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

    Filesize

    8KB

  • memory/1480-76-0x0000000000230000-0x0000000000449000-memory.dmp

    Filesize

    2.1MB

  • memory/1480-77-0x0000000001ED0000-0x00000000020FA000-memory.dmp

    Filesize

    2.2MB

  • memory/1480-74-0x0000000002100000-0x0000000002240000-memory.dmp

    Filesize

    1.2MB

  • memory/1480-73-0x0000000002100000-0x0000000002240000-memory.dmp

    Filesize

    1.2MB

  • memory/1852-63-0x0000000003260000-0x0000000003985000-memory.dmp

    Filesize

    7.1MB

  • memory/1852-70-0x0000000003990000-0x0000000003AD0000-memory.dmp

    Filesize

    1.2MB

  • memory/1852-71-0x0000000003990000-0x0000000003AD0000-memory.dmp

    Filesize

    1.2MB

  • memory/1852-78-0x0000000003260000-0x0000000003985000-memory.dmp

    Filesize

    7.1MB

  • memory/1852-69-0x0000000003990000-0x0000000003AD0000-memory.dmp

    Filesize

    1.2MB

  • memory/1852-66-0x0000000003990000-0x0000000003AD0000-memory.dmp

    Filesize

    1.2MB

  • memory/1852-65-0x0000000003990000-0x0000000003AD0000-memory.dmp

    Filesize

    1.2MB

  • memory/1852-64-0x0000000003990000-0x0000000003AD0000-memory.dmp

    Filesize

    1.2MB

  • memory/1852-62-0x0000000003260000-0x0000000003985000-memory.dmp

    Filesize

    7.1MB

  • memory/1852-60-0x0000000003260000-0x0000000003985000-memory.dmp

    Filesize

    7.1MB

  • memory/1852-59-0x0000000003260000-0x0000000003985000-memory.dmp

    Filesize

    7.1MB

  • memory/1852-58-0x0000000002110000-0x0000000002381000-memory.dmp

    Filesize

    2.4MB

  • memory/1852-57-0x0000000002110000-0x0000000002381000-memory.dmp

    Filesize

    2.4MB

  • memory/1852-56-0x0000000002110000-0x0000000002381000-memory.dmp

    Filesize

    2.4MB

  • memory/1852-55-0x0000000075521000-0x0000000075523000-memory.dmp

    Filesize

    8KB