danabot | 05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2022 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b.exe
Size

220KB
MD5

a6d507b8992534fc63131c7b5118b44a
SHA1

94b80fca4ff1065e73da21f5e66ec7ffd7597b80
SHA256

05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b
SHA512

817bebe22dc0b21679d96556553ff6f85bc9b1b78cd3a907bde7cad0732bc8ec485428ac8a5d8aa49fc5779c6eead380e9bf43092c8d780b5c57d3be2a976d7b
SSDEEP

3072:nY9FpLpqw115pJSQvh5TdW/9jbeN1IQV7b/yAug2oNHCDml:qHLpqwdvp64FjbCa

Score

10^/10

danabot smokeloader backdoor banker discovery trojan

Malware Config

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2220-133-0x0000000000470000-0x0000000000479000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

91 2672 rundll32.exe
94 2672 rundll32.exe
108 2672 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

DB03.exeficbhbs

pid process

724 DB03.exe
2556 ficbhbs
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2672 rundll32.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2672 set thread context of 4220 2672 rundll32.exe rundll32.exe

flow	pid	process
91	2672	rundll32.exe
94	2672	rundll32.exe
108	2672	rundll32.exe

pid	process
724	DB03.exe
2556	ficbhbs

pid	process
2672	rundll32.exe

description	pid	process	target process
PID 2672 set thread context of 4220	2672	rundll32.exe	rundll32.exe

Drops file in Program Files directory 37 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Adobe.Reader.Dependencies.manifest	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\2d.x3d	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeXMP.dll	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\server_ok.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\A3DUtils.dll	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\CollectSignatures.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\RTC.der	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\adobe_spinner.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\OptimizePDF_R_RHP.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Close.png	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\OptimizePDF_R_RHP.aapp	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\SignHere.pdf	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ADelRCP.exe	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\AdobeID.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\AddressBook.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_shared.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\trash.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\review_shared.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Checkers.api	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\aic_file_icons_retina_thumb_highContrast_bow.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\trash.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\form_responses.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\AddressBook.png	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Close.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\A3DUtils.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RTC.der	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\AdobeXMP.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4088 724 WerFault.exe DB03.exe

pid	pid_target	process	target process
4088	724	WerFault.exe	DB03.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ficbhbs05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ficbhbs
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ficbhbs
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ficbhbs

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Modifies registry class 30 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000095552021100054656d7000003a0009000400efbe0c551999955522212e00000000000000000000000000000000000000000000000000df962301540065006d007000000014000000
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pid process

700

pid	process
700

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b.exe

pid	process
2220	05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b.exe
2220	05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b.exe
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700
700

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

700
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b.exeficbhbs

pid process

2220 05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b.exe
2556 ficbhbs

pid	process
700

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700
Token: SeShutdownPrivilege	700
Token: SeCreatePagefilePrivilege	700

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

4220 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pid process

700
700

pid	process
4220	rundll32.exe

pid	process
700
700

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

DB03.exerundll32.exe

description	pid	process	target process
PID 700 wrote to memory of 724	700		DB03.exe
PID 700 wrote to memory of 724	700		DB03.exe
PID 700 wrote to memory of 724	700		DB03.exe
PID 724 wrote to memory of 2672	724	DB03.exe	rundll32.exe
PID 724 wrote to memory of 2672	724	DB03.exe	rundll32.exe
PID 724 wrote to memory of 2672	724	DB03.exe	rundll32.exe
PID 2672 wrote to memory of 4220	2672	rundll32.exe	rundll32.exe
PID 2672 wrote to memory of 4220	2672	rundll32.exe	rundll32.exe
PID 2672 wrote to memory of 4220	2672	rundll32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b.exe
"C:\Users\Admin\AppData\Local\Temp\05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2220

C:\Users\Admin\AppData\Local\Temp\DB03.exe
C:\Users\Admin\AppData\Local\Temp\DB03.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14144
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 724 -s 528
2⤵
- Program crash
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 724 -ip 724
1⤵
PID:3448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4512

C:\Users\Admin\AppData\Roaming\ficbhbs
C:\Users\Admin\AppData\Roaming\ficbhbs
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2556

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k LocalService
1⤵
PID:4628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WindowsPowerShell\Modules\aic_file_icons_retina_thumb_highContrast_bow.dll
Filesize
797KB

MD5
c2461609355f98f485b4d1a152193908

SHA1
4cb4e8a50d7d667404362be7acc503ffed03feec

SHA256
952ae313561ce8589d1268999ff89bffbbd946901d9ae1869eeb58624c038a27

SHA512
d1218d3b71a03acb108689602ad1ce3f961b2352cb404f5eb3d704587cc33fb033a023a2d64999552e236fc8d2ef80cbda2011116181234d73d86c178eca257d

Download Submit
C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp
Filesize
1.2MB

MD5
30a8557d3b8544d542a04d266989917d

SHA1
99d869f29a5bbe47b880c2924b2e8aeb0fa2da13

SHA256
a321413684106f176f80e5bcb7e6b2a1dcf89831f785bfac13882b2cbb458076

SHA512
4d9e8160fb07b10491cf145ec5641c181659717bc93d9b519bbfb2ad0cf877f1c51ed578c09181cab291d269b4800e21b05c83e272ad1c007a49e0ff797be28e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB03.exe
Filesize
1.1MB

MD5
7e9ce657b646e0ecff706bf6680061f0

SHA1
8f576b573c55ba4b3a36b495e9ab0361270b0fd7

SHA256
f657d6f8f072dcf10f48e03b3b813cb9ab9c4b975dec12e9db8da868d3e50ab9

SHA512
360890279533d6ad72f3640c31d7b7b69e5189ea65ca802e6855d6f874005838282b1caf0dde21ebcacc185d8db3229cf3c7fd4414a30660176ad4a6d352361d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB03.exe
Filesize
1.1MB

MD5
7e9ce657b646e0ecff706bf6680061f0

SHA1
8f576b573c55ba4b3a36b495e9ab0361270b0fd7

SHA256
f657d6f8f072dcf10f48e03b3b813cb9ab9c4b975dec12e9db8da868d3e50ab9

SHA512
360890279533d6ad72f3640c31d7b7b69e5189ea65ca802e6855d6f874005838282b1caf0dde21ebcacc185d8db3229cf3c7fd4414a30660176ad4a6d352361d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp
Filesize
797KB

MD5
24925b25552a7d8f1d3292071e545920

SHA1
f786e1d40df30f6fed0301d60c823b655f2d6eac

SHA256
9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

SHA512
242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp
Filesize
797KB

MD5
24925b25552a7d8f1d3292071e545920

SHA1
f786e1d40df30f6fed0301d60c823b655f2d6eac

SHA256
9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

SHA512
242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

Download Submit
C:\Users\Admin\AppData\Roaming\ficbhbs
Filesize
220KB

MD5
a6d507b8992534fc63131c7b5118b44a

SHA1
94b80fca4ff1065e73da21f5e66ec7ffd7597b80

SHA256
05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b

SHA512
817bebe22dc0b21679d96556553ff6f85bc9b1b78cd3a907bde7cad0732bc8ec485428ac8a5d8aa49fc5779c6eead380e9bf43092c8d780b5c57d3be2a976d7b

Download Submit
C:\Users\Admin\AppData\Roaming\ficbhbs
Filesize
220KB

MD5
a6d507b8992534fc63131c7b5118b44a

SHA1
94b80fca4ff1065e73da21f5e66ec7ffd7597b80

SHA256
05edc8d9f36c5f1d93dc7bd7919b1db3c1b8a20921904ab31f443b59582c3c4b

SHA512
817bebe22dc0b21679d96556553ff6f85bc9b1b78cd3a907bde7cad0732bc8ec485428ac8a5d8aa49fc5779c6eead380e9bf43092c8d780b5c57d3be2a976d7b

Download Submit
\??\c:\program files (x86)\windowspowershell\modules\aic_file_icons_retina_thumb_highcontrast_bow.dll
Filesize
797KB

MD5
c2461609355f98f485b4d1a152193908

SHA1
4cb4e8a50d7d667404362be7acc503ffed03feec

SHA256
952ae313561ce8589d1268999ff89bffbbd946901d9ae1869eeb58624c038a27

SHA512
d1218d3b71a03acb108689602ad1ce3f961b2352cb404f5eb3d704587cc33fb033a023a2d64999552e236fc8d2ef80cbda2011116181234d73d86c178eca257d

Download Submit
memory/724-139-0x0000000000805000-0x00000000008F4000-memory.dmp

Filesize
956KB

Download
memory/724-142-0x0000000000400000-0x0000000000540000-memory.dmp

Filesize
1.2MB

Download
memory/724-141-0x00000000023A0000-0x00000000024D0000-memory.dmp

Filesize
1.2MB

Download
memory/724-136-0x0000000000000000-mapping.dmp

Download
memory/2220-134-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2220-133-0x0000000000470000-0x0000000000479000-memory.dmp

Filesize
36KB

Download
memory/2220-135-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2220-132-0x00000000004A2000-0x00000000004B2000-memory.dmp

Filesize
64KB

Download
memory/2556-164-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2556-163-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2556-162-0x0000000000773000-0x0000000000784000-memory.dmp

Filesize
68KB

Download
memory/2672-150-0x0000000005070000-0x00000000051B0000-memory.dmp

Filesize
1.2MB

Download
memory/2672-159-0x0000000004780000-0x0000000004EA5000-memory.dmp

Filesize
7.1MB

Download
memory/2672-140-0x0000000000000000-mapping.dmp

Download
memory/2672-145-0x0000000004780000-0x0000000004EA5000-memory.dmp

Filesize
7.1MB

Download
memory/2672-154-0x00000000050E9000-0x00000000050EB000-memory.dmp

Filesize
8KB

Download
memory/2672-146-0x0000000004780000-0x0000000004EA5000-memory.dmp

Filesize
7.1MB

Download
memory/2672-147-0x0000000005070000-0x00000000051B0000-memory.dmp

Filesize
1.2MB

Download
memory/2672-148-0x0000000005070000-0x00000000051B0000-memory.dmp

Filesize
1.2MB

Download
memory/2672-152-0x0000000005070000-0x00000000051B0000-memory.dmp

Filesize
1.2MB

Download
memory/2672-151-0x0000000005070000-0x00000000051B0000-memory.dmp

Filesize
1.2MB

Download
memory/2672-149-0x0000000005070000-0x00000000051B0000-memory.dmp

Filesize
1.2MB

Download
memory/4220-153-0x00007FF6A40C6890-mapping.dmp

Download
memory/4220-158-0x00000203E9AD0000-0x00000203E9CFA000-memory.dmp

Filesize
2.2MB

Download
memory/4220-157-0x0000000000820000-0x0000000000A39000-memory.dmp

Filesize
2.1MB

Download
memory/4220-156-0x00000203EB4A0000-0x00000203EB5E0000-memory.dmp

Filesize
1.2MB

Download
memory/4220-155-0x00000203EB4A0000-0x00000203EB5E0000-memory.dmp

Filesize
1.2MB

Download