Analysis

  • max time kernel
    81s
  • max time network
    113s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    20/12/2022, 14:30

General

  • Target

    c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628.dll

  • Size

    2.4MB

  • MD5

    3b8bdfd2524da789d5611e1877c89f5d

  • SHA1

    e6b3400bfed1e2d367b78e9bfe5188401eb742f6

  • SHA256

    c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628

  • SHA512

    f779fc56f058b03f003901f454e4160b18cf88753face31f3c1401511e997e4f4b4f5ca4a74f7759bb74a1f3fa6c974af1bee76df55ace747f5022ecbf341dde

  • SSDEEP

    49152:zrqVHNsAsWe8AdaSTBfA3XGGuGATN8LxZ:zaPenfA32r8Lz

Score
10/10

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 24 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 20228
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1544

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1392-65-0x0000000003C80000-0x0000000003DC0000-memory.dmp

    Filesize

    1.2MB

  • memory/1392-63-0x0000000003490000-0x0000000003BB5000-memory.dmp

    Filesize

    7.1MB

  • memory/1392-56-0x0000000001FB0000-0x0000000002221000-memory.dmp

    Filesize

    2.4MB

  • memory/1392-57-0x0000000001FB0000-0x0000000002221000-memory.dmp

    Filesize

    2.4MB

  • memory/1392-58-0x0000000001FB0000-0x0000000002221000-memory.dmp

    Filesize

    2.4MB

  • memory/1392-59-0x0000000003490000-0x0000000003BB5000-memory.dmp

    Filesize

    7.1MB

  • memory/1392-60-0x0000000003490000-0x0000000003BB5000-memory.dmp

    Filesize

    7.1MB

  • memory/1392-78-0x0000000003490000-0x0000000003BB5000-memory.dmp

    Filesize

    7.1MB

  • memory/1392-66-0x0000000003EE0000-0x0000000004020000-memory.dmp

    Filesize

    1.2MB

  • memory/1392-64-0x0000000003C80000-0x0000000003DC0000-memory.dmp

    Filesize

    1.2MB

  • memory/1392-55-0x00000000759C1000-0x00000000759C3000-memory.dmp

    Filesize

    8KB

  • memory/1392-62-0x0000000003490000-0x0000000003BB5000-memory.dmp

    Filesize

    7.1MB

  • memory/1392-69-0x0000000003EE0000-0x0000000004020000-memory.dmp

    Filesize

    1.2MB

  • memory/1392-71-0x0000000003C80000-0x0000000003DC0000-memory.dmp

    Filesize

    1.2MB

  • memory/1392-70-0x0000000003C80000-0x0000000003DC0000-memory.dmp

    Filesize

    1.2MB

  • memory/1544-73-0x0000000002320000-0x0000000002460000-memory.dmp

    Filesize

    1.2MB

  • memory/1544-74-0x0000000002320000-0x0000000002460000-memory.dmp

    Filesize

    1.2MB

  • memory/1544-75-0x000007FEFBA21000-0x000007FEFBA23000-memory.dmp

    Filesize

    8KB

  • memory/1544-76-0x0000000000120000-0x0000000000339000-memory.dmp

    Filesize

    2.1MB

  • memory/1544-77-0x0000000001F50000-0x000000000217A000-memory.dmp

    Filesize

    2.2MB

  • memory/1544-67-0x0000000000120000-0x0000000000339000-memory.dmp

    Filesize

    2.1MB