Analysis

  • max time kernel
    116s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2022, 14:30

General

  • Target

    c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628.dll

  • Size

    2.4MB

  • MD5

    3b8bdfd2524da789d5611e1877c89f5d

  • SHA1

    e6b3400bfed1e2d367b78e9bfe5188401eb742f6

  • SHA256

    c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628

  • SHA512

    f779fc56f058b03f003901f454e4160b18cf88753face31f3c1401511e997e4f4b4f5ca4a74f7759bb74a1f3fa6c974af1bee76df55ace747f5022ecbf341dde

  • SSDEEP

    49152:zrqVHNsAsWe8AdaSTBfA3XGGuGATN8LxZ:zaPenfA32r8Lz

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 3 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5080
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 20229
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:4160
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:3732
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:1040
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:4340
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe -k LocalService
          1⤵
          • Loads dropped DLL
          PID:2844
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\msbuild\microsoft\64bitmapibroker.dll",PyQbeTJXNWs=
            2⤵
              PID:4884

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\MSBuild\Microsoft\64BitMAPIBroker.dll

            Filesize

            2.4MB

            MD5

            7ffb83c8928acd22a1438b000875f303

            SHA1

            efc88722e356776628004f5d31ab60bf13f761fa

            SHA256

            19f8c12bda4c14fd92b6344769acb00649abde2643d974d3f974195acbd54eb2

            SHA512

            413054d65095e35ddf537e4e9ee6c7498356414d624b9bae5997156602fa3d7990615c141e3ef653cd1251b9b44bdee4f0acff4b51073ea4653e53aa6d95e742

          • C:\Program Files (x86)\MSBuild\Microsoft\64BitMAPIBroker.dll

            Filesize

            2.4MB

            MD5

            7ffb83c8928acd22a1438b000875f303

            SHA1

            efc88722e356776628004f5d31ab60bf13f761fa

            SHA256

            19f8c12bda4c14fd92b6344769acb00649abde2643d974d3f974195acbd54eb2

            SHA512

            413054d65095e35ddf537e4e9ee6c7498356414d624b9bae5997156602fa3d7990615c141e3ef653cd1251b9b44bdee4f0acff4b51073ea4653e53aa6d95e742

          • C:\Program Files (x86)\MSBuild\Microsoft\64BitMAPIBroker.dll

            Filesize

            2.4MB

            MD5

            7ffb83c8928acd22a1438b000875f303

            SHA1

            efc88722e356776628004f5d31ab60bf13f761fa

            SHA256

            19f8c12bda4c14fd92b6344769acb00649abde2643d974d3f974195acbd54eb2

            SHA512

            413054d65095e35ddf537e4e9ee6c7498356414d624b9bae5997156602fa3d7990615c141e3ef653cd1251b9b44bdee4f0acff4b51073ea4653e53aa6d95e742

          • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml

            Filesize

            14KB

            MD5

            cc78ff3a9bbf1967185797f3eac2090a

            SHA1

            80204fdfac8110dddc7e5c59ada69feef33a0614

            SHA256

            7afbc0905a69b223e8098f1a9b34fcf454ba79535873933df9c12dc8660174c3

            SHA512

            5ecf695a9be7c5521d1429fe696cb7d1d4d361b43f819b77e76828d5314e444ad61bd3c66f1cd7b7fea9c6138808a1194bc556cd5195658132121444d5a3636d

          • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Daowpeywwstdp.tmp

            Filesize

            2.3MB

            MD5

            eb30d9fd8ce1e776d7247c252edafe5b

            SHA1

            5ae2b4d53c89287dbbf3850089241683b170b277

            SHA256

            268c2ebc133d6d755b83bf2809ea49ef6b01c208d01954a0e8a5f1d6bcaee93f

            SHA512

            0135c840f2f74b2dd4f0b6f1c679b54363598f92e1dd5c6b19307b7a0e0fcd8a20867b9fd686c3974ab8400e5ac75d258c8e1f2b3a798058f690fb73d937b595

          • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe.xml

            Filesize

            849B

            MD5

            cff245d69fe04eec05ce3601d77467b6

            SHA1

            d09b1d953eea98ef0b0fcec5936fc806940f7717

            SHA256

            40d6a0b80770bf41ddc0a3b3607ac53eb82d0f90675e5a595a18cd3f8bdf3d94

            SHA512

            4615affbbc7163076cbc82a8e65cd5d168d1411a028b47bddd0ec5219e08037304de1d14ae1fa659909760150edf5401e698c9f6252674eb4e84dec341aa3666

          • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe.xml

            Filesize

            7KB

            MD5

            b290178a94a0bd93830d5714c11f9681

            SHA1

            9dd5d3337117568b6423a32dff9baf14fb11e73c

            SHA256

            5876d6a887dd7db15a3bea28e71c0aa044023eafb1eed8ca9356035f5943249c

            SHA512

            ef5af5bc01510ea6e865e11a94bcf67966a01930fcdd9ab10bcb854a06976f59c909bd10e9ff3ef0aea53bad9a4af510401c05ada4c017e45ff512a127dea9fb

          • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml

            Filesize

            3KB

            MD5

            1a3168a15983b890b16390a23a89a02e

            SHA1

            d56ce16d88d79159a27c2d1cd3770dc56d897ebe

            SHA256

            334782208e9520975f597b19a273fcc6f3a8a7caffd2e4fb22213f6b957f4946

            SHA512

            f2be33992fd70d90eb94973c19924229bb70da4ce21c9777cfccbf56b0635452b382d2846afe2b0cc80a83d3b6a2c855557855cfb22fc681d182b2b605daa668

          • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\SmsInterceptStore.db

            Filesize

            192KB

            MD5

            5fa49c1c863990caa01994342272b2c9

            SHA1

            c52d1577b2907b462141e4ce74dc8563e52f00c8

            SHA256

            bd19746ccaba594171cffbd9c31e144d1c29746fbfe484f787aaed83e5723b93

            SHA512

            3e1b1ec930ede363e2517fa33cf892295f2836af9843ac0216295624720fccbef643728b1998ce314d63e5409c4df95832933baca9d0b048ed8979c4fc4e20d7

          • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\edb.jcp

            Filesize

            8KB

            MD5

            47f72135861cdde114ff79287e6006b6

            SHA1

            22b81b4310df90e5e32f1016bb574f49d21da132

            SHA256

            5c181fcf614064eb54823e6e4c43eee7412e6bd3d7901b4f816c39be45dcd12e

            SHA512

            d900e3d9e9f0cfdc47a5ba534642938e96d666f1f5cbb93ec20e3f7a2ec96780fc919566bc61501d2c665212b7118d264342d124e6665e98b09ddccc733983e1

          • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\edb00002.log

            Filesize

            64KB

            MD5

            ec3d0a4df5f4aa1e3ee117d0357f73bc

            SHA1

            054cbdffe6d2f7d26acb41f95c7e56d90f9b2ad3

            SHA256

            fccf5697101241b32bcf5fc3ef0469ce8eefc1a91518640d973f2cc859fb7589

            SHA512

            cc1060099a17ae7b6bdbbb58a207d081020eb0b5fc0be537e42ee55bd4921b4039a50014af46fbca8374cb0d1cf6a0fc1e892d82947d76a79e84038287802580

          • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\utc.app.json.bk

            Filesize

            96KB

            MD5

            f98f89ae9f3b3417b2b0f05bb4c870c7

            SHA1

            7004300e9f11fef74473f99ade3ed71d8c34dd22

            SHA256

            2a31397b5d41194cbe8cb86b19cf7ea4d82e5a43bdabe68d4cda297592701a22

            SHA512

            9532f2b1037734bfd9857e5939d0699071fd645486eb2de6a550b72e60df7fe79664ff1f091a3e8ee39ac913aae044f1526365580e0805dda038137ef5ea7899

          • \??\c:\program files (x86)\msbuild\microsoft\64bitmapibroker.dll

            Filesize

            2.4MB

            MD5

            7ffb83c8928acd22a1438b000875f303

            SHA1

            efc88722e356776628004f5d31ab60bf13f761fa

            SHA256

            19f8c12bda4c14fd92b6344769acb00649abde2643d974d3f974195acbd54eb2

            SHA512

            413054d65095e35ddf537e4e9ee6c7498356414d624b9bae5997156602fa3d7990615c141e3ef653cd1251b9b44bdee4f0acff4b51073ea4653e53aa6d95e742

          • memory/2844-168-0x00000000022F0000-0x0000000002A15000-memory.dmp

            Filesize

            7.1MB

          • memory/2844-161-0x0000000000400000-0x0000000000671000-memory.dmp

            Filesize

            2.4MB

          • memory/2844-162-0x00000000022F0000-0x0000000002A15000-memory.dmp

            Filesize

            7.1MB

          • memory/2844-163-0x00000000022F0000-0x0000000002A15000-memory.dmp

            Filesize

            7.1MB

          • memory/2844-177-0x0000000000400000-0x0000000000671000-memory.dmp

            Filesize

            2.4MB

          • memory/2844-178-0x00000000022F0000-0x0000000002A15000-memory.dmp

            Filesize

            7.1MB

          • memory/4160-148-0x0000000000D00000-0x0000000000F19000-memory.dmp

            Filesize

            2.1MB

          • memory/4160-149-0x000002DA79050000-0x000002DA7927A000-memory.dmp

            Filesize

            2.2MB

          • memory/4160-147-0x000002DA7AA20000-0x000002DA7AB60000-memory.dmp

            Filesize

            1.2MB

          • memory/4160-146-0x000002DA7AA20000-0x000002DA7AB60000-memory.dmp

            Filesize

            1.2MB

          • memory/4884-167-0x0000000000B70000-0x0000000000DE1000-memory.dmp

            Filesize

            2.4MB

          • memory/4884-169-0x0000000000B70000-0x0000000000DE1000-memory.dmp

            Filesize

            2.4MB

          • memory/4884-174-0x0000000002AD0000-0x00000000031F5000-memory.dmp

            Filesize

            7.1MB

          • memory/4884-173-0x0000000000B70000-0x0000000000DE1000-memory.dmp

            Filesize

            2.4MB

          • memory/4884-172-0x0000000002AD0000-0x00000000031F5000-memory.dmp

            Filesize

            7.1MB

          • memory/4884-171-0x0000000002AD0000-0x00000000031F5000-memory.dmp

            Filesize

            7.1MB

          • memory/5080-139-0x0000000003CF0000-0x0000000003E30000-memory.dmp

            Filesize

            1.2MB

          • memory/5080-140-0x0000000003CF0000-0x0000000003E30000-memory.dmp

            Filesize

            1.2MB

          • memory/5080-138-0x0000000003500000-0x0000000003C25000-memory.dmp

            Filesize

            7.1MB

          • memory/5080-150-0x0000000003500000-0x0000000003C25000-memory.dmp

            Filesize

            7.1MB

          • memory/5080-137-0x0000000003500000-0x0000000003C25000-memory.dmp

            Filesize

            7.1MB

          • memory/5080-141-0x0000000003CF0000-0x0000000003E30000-memory.dmp

            Filesize

            1.2MB

          • memory/5080-143-0x0000000003CF0000-0x0000000003E30000-memory.dmp

            Filesize

            1.2MB

          • memory/5080-142-0x0000000003CF0000-0x0000000003E30000-memory.dmp

            Filesize

            1.2MB

          • memory/5080-144-0x0000000003CF0000-0x0000000003E30000-memory.dmp

            Filesize

            1.2MB

          • memory/5080-136-0x0000000003500000-0x0000000003C25000-memory.dmp

            Filesize

            7.1MB

          • memory/5080-135-0x0000000002410000-0x0000000002681000-memory.dmp

            Filesize

            2.4MB

          • memory/5080-134-0x0000000002410000-0x0000000002681000-memory.dmp

            Filesize

            2.4MB

          • memory/5080-133-0x0000000002410000-0x0000000002681000-memory.dmp

            Filesize

            2.4MB