Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2022, 14:30

General

  • Target

    c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628.dll

  • Size

    2.4MB

  • MD5

    3b8bdfd2524da789d5611e1877c89f5d

  • SHA1

    e6b3400bfed1e2d367b78e9bfe5188401eb742f6

  • SHA256

    c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628

  • SHA512

    f779fc56f058b03f003901f454e4160b18cf88753face31f3c1401511e997e4f4b4f5ca4a74f7759bb74a1f3fa6c974af1bee76df55ace747f5022ecbf341dde

  • SSDEEP

    49152:zrqVHNsAsWe8AdaSTBfA3XGGuGATN8LxZ:zaPenfA32r8Lz

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 3 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c05d24cef02f3b536d07d706a1446fb93e8fbf6c0e650fbbbf55aed8e14a7628.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:5016
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 20188
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:4576
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:2148
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:708
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:2624
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe -k LocalService
          1⤵
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4348
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\msbuild\microsoft\combine_r_rhp..dll",JyYBYg==
            2⤵
            • Loads dropped DLL
            • Checks processor information in registry
            PID:2008

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\MSBuild\Microsoft\Combine_R_RHP..dll

          Filesize

          2.4MB

          MD5

          e141c8abc733854f1c10467debaf0522

          SHA1

          17b7e279cd3709523497774b192ee0ae27648a70

          SHA256

          51b1d305d9e72f5f66df62130000de540bead9e47f76e066e8d898e8467a8a40

          SHA512

          32726e11f9222e5069bc9819b52333ec6710356589ef005d4af6c97cbc104fe7fe2f6fea8289150b3bff89f83efae3225399b9e5501745da5869d0837a3f48b5

        • C:\Program Files (x86)\MSBuild\Microsoft\Combine_R_RHP..dll

          Filesize

          2.4MB

          MD5

          e141c8abc733854f1c10467debaf0522

          SHA1

          17b7e279cd3709523497774b192ee0ae27648a70

          SHA256

          51b1d305d9e72f5f66df62130000de540bead9e47f76e066e8d898e8467a8a40

          SHA512

          32726e11f9222e5069bc9819b52333ec6710356589ef005d4af6c97cbc104fe7fe2f6fea8289150b3bff89f83efae3225399b9e5501745da5869d0837a3f48b5

        • C:\Program Files (x86)\MSBuild\Microsoft\Combine_R_RHP..dll

          Filesize

          2.4MB

          MD5

          e141c8abc733854f1c10467debaf0522

          SHA1

          17b7e279cd3709523497774b192ee0ae27648a70

          SHA256

          51b1d305d9e72f5f66df62130000de540bead9e47f76e066e8d898e8467a8a40

          SHA512

          32726e11f9222e5069bc9819b52333ec6710356589ef005d4af6c97cbc104fe7fe2f6fea8289150b3bff89f83efae3225399b9e5501745da5869d0837a3f48b5

        • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy.xml

          Filesize

          2KB

          MD5

          d2d725a3c34b3597b164a038ec06085a

          SHA1

          52eb2334afeccafd46b205de0d2c7306cb7b7c8d

          SHA256

          01bc9a89105cebd77ff81b814f794a71cbccf40f4d3e663758e63e202f5e1f00

          SHA512

          6f23fc81a4a5308966892ef880048ff079aec5968af5d6fcc0315c05533d597865b0572d18e0368da4ff85c9136b87a4cb9e878bc28738a18025d576b5a3f306

        • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\C2RManifest.wordmui.msi.16.en-us.xml

          Filesize

          77KB

          MD5

          50a33f3ee76c3f15703f82890efcc8c8

          SHA1

          b24e99bb702478edcbbda43f75457e5833abdc95

          SHA256

          77a2a4517a0c488c78bf9742e86de5af419d6c148346845d8b0f062d5f8a631a

          SHA512

          f14e224c1582476f09f969f1e29d5e2fa7855b22aa6b35682e264da0fc6cafdc1d62022dde5032206e1d973382604d9ccfa7495ebf90578a55c9c74bac1e606e

        • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Daowpeywwstdp.tmp

          Filesize

          512KB

          MD5

          3dfb75fdfd4cd526344faa5d7da1e04f

          SHA1

          259783ab4ff58c0b29c6490c81f0bc7ba06845e2

          SHA256

          78a8994b136c70a2cf06f25065dd30fff37d6b6652bdfc499ee06dff6214a845

          SHA512

          a42dc3b84aa68d22ef3132a9e1a3fc760eb38a82757afd09063e61bd4b3fd2b7dd90ab8574b65f3e8edb3054c4d3c9090c52f18f63c8a5fb12921e50513aabae

        • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Daowpeywwstdp.tmp

          Filesize

          2.3MB

          MD5

          4e47933ed8915445ef3f4988a44f4aa2

          SHA1

          aa2dfe37951f15098711a1fb2d480e58ca5edc47

          SHA256

          7b67aa4c2e709a761df65c04a3e223a490b596ebc34c6d10e00dccd2804a27fd

          SHA512

          67f7fe8d1e844482f034949dd116a3ca742290a68c3ff693f1a6c38439ef36cd1def05f21ad5bed7a1c5bf3c57e0e358c019ae8fca36a8826fc321f2d6f6f83f

        • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Microsoft.AsyncTextService_10.0.19041.1023_neutral__8wekyb3d8bbwe.xml

          Filesize

          2KB

          MD5

          2240070d6603ab019cd125005cf38b7b

          SHA1

          ca96d028f51a7d5ec16630b48935f26c72794b0a

          SHA256

          7b3b1b641ebbda5397a11af86cb347b0f644ab439341c62b1c81d6990e6f75bc

          SHA512

          95c6f48f717d9103d30c31e00b7ff3a0d235693a8fffed772c0a0c39107bf3003ac84d6c78e2af566d91a88fa523dcc2c523dcc707d19fc77799832d548f330c

        • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Microsoft.MicrosoftEdgeDevToolsClient_1000.19041.1023.0_neutral_neutral_8wekyb3d8bbwe.xml

          Filesize

          1KB

          MD5

          cf0330a44354655f192bc5f1976564e5

          SHA1

          d993f0dbfdb68552bbf3381d07fb2b26b79e16aa

          SHA256

          9727e4d3cf3fcc5dcc364cd990f41a4be98d227b0ce975fa97cef0ef8eaa5b78

          SHA512

          36aeacbb9b0d6ed2a51d23376ab6e583c258c128bf3de0069523441dda98a68a65592792ebd883a7ea8f21768da91c9826a4551cf9e02c01480110941b6e401a

        • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\MicrosoftOffice2013Win64.xml

          Filesize

          66KB

          MD5

          c08e2d9084398ad29bb453183bb2155d

          SHA1

          285b0d897ff73444a74bf9e253d30f7cb1f4f2be

          SHA256

          9ddc306cee7a71d98fe59c39ce5fb74cc7e36c54a55cc46f2e8136c12e890418

          SHA512

          d032acce3071bb26d688aa4a816d09b6852c3ccb179f66a0001038b94f556a4b04401e02a4dc3b8eb7f4c4aa0fb74aa009a5db786972c56cb08d5dbeeaefad83

        • \??\c:\program files (x86)\msbuild\microsoft\combine_r_rhp..dll

          Filesize

          2.4MB

          MD5

          e141c8abc733854f1c10467debaf0522

          SHA1

          17b7e279cd3709523497774b192ee0ae27648a70

          SHA256

          51b1d305d9e72f5f66df62130000de540bead9e47f76e066e8d898e8467a8a40

          SHA512

          32726e11f9222e5069bc9819b52333ec6710356589ef005d4af6c97cbc104fe7fe2f6fea8289150b3bff89f83efae3225399b9e5501745da5869d0837a3f48b5

        • memory/2008-167-0x0000000000400000-0x0000000000671000-memory.dmp

          Filesize

          2.4MB

        • memory/2008-168-0x0000000003120000-0x0000000003845000-memory.dmp

          Filesize

          7.1MB

        • memory/2008-169-0x0000000003120000-0x0000000003845000-memory.dmp

          Filesize

          7.1MB

        • memory/2008-174-0x0000000000400000-0x0000000000671000-memory.dmp

          Filesize

          2.4MB

        • memory/2008-175-0x0000000003120000-0x0000000003845000-memory.dmp

          Filesize

          7.1MB

        • memory/4348-161-0x0000000001B60000-0x0000000002285000-memory.dmp

          Filesize

          7.1MB

        • memory/4348-153-0x0000000001200000-0x0000000001471000-memory.dmp

          Filesize

          2.4MB

        • memory/4348-179-0x0000000001B60000-0x0000000002285000-memory.dmp

          Filesize

          7.1MB

        • memory/4348-154-0x0000000001200000-0x0000000001471000-memory.dmp

          Filesize

          2.4MB

        • memory/4348-159-0x0000000001B60000-0x0000000002285000-memory.dmp

          Filesize

          7.1MB

        • memory/4348-160-0x0000000001B60000-0x0000000002285000-memory.dmp

          Filesize

          7.1MB

        • memory/4348-178-0x0000000001200000-0x0000000001471000-memory.dmp

          Filesize

          2.4MB

        • memory/4576-148-0x000001AF79D80000-0x000001AF79FAA000-memory.dmp

          Filesize

          2.2MB

        • memory/4576-147-0x0000000000AE0000-0x0000000000CF9000-memory.dmp

          Filesize

          2.1MB

        • memory/4576-146-0x000001AF7B760000-0x000001AF7B8A0000-memory.dmp

          Filesize

          1.2MB

        • memory/4576-145-0x000001AF7B760000-0x000001AF7B8A0000-memory.dmp

          Filesize

          1.2MB

        • memory/5016-141-0x0000000003EF0000-0x0000000004030000-memory.dmp

          Filesize

          1.2MB

        • memory/5016-142-0x0000000003EF0000-0x0000000004030000-memory.dmp

          Filesize

          1.2MB

        • memory/5016-140-0x0000000003EF0000-0x0000000004030000-memory.dmp

          Filesize

          1.2MB

        • memory/5016-138-0x0000000003EF0000-0x0000000004030000-memory.dmp

          Filesize

          1.2MB

        • memory/5016-139-0x0000000003EF0000-0x0000000004030000-memory.dmp

          Filesize

          1.2MB

        • memory/5016-137-0x0000000003700000-0x0000000003E25000-memory.dmp

          Filesize

          7.1MB

        • memory/5016-136-0x0000000003700000-0x0000000003E25000-memory.dmp

          Filesize

          7.1MB

        • memory/5016-135-0x0000000003700000-0x0000000003E25000-memory.dmp

          Filesize

          7.1MB

        • memory/5016-134-0x0000000000400000-0x0000000000671000-memory.dmp

          Filesize

          2.4MB

        • memory/5016-133-0x0000000000400000-0x0000000000671000-memory.dmp

          Filesize

          2.4MB

        • memory/5016-143-0x0000000003EF0000-0x0000000004030000-memory.dmp

          Filesize

          1.2MB

        • memory/5016-149-0x0000000003700000-0x0000000003E25000-memory.dmp

          Filesize

          7.1MB