Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/07/2024, 13:30

General

  • Target

    403DA0C043C2998DA98D36702AF8795548DC51B836BE342D9F2BE808B07D6FB9.exe

  • Size

    1.1MB

  • MD5

    fa43013cb8f1c2548f1ae8e73ff602ab

  • SHA1

    6ff459d4c88b399c0f54c83659188380a322bb99

  • SHA256

    6acc0714d3cbab8c42b03d03044f0c56134ed9a651bd1f7a88d8c8f56c978f6a

  • SHA512

    acb3b6c8629d875d05740d0307a42758c49bd288e342f5fefe38056053104a8616fca73f9a6b94f2ef93be2e043bec2edf1c9e165249824f65c8e8ec56e5e297

  • SSDEEP

    24576:uzjX1tNkven7slbDiEqVSwJ9PioVFYKvWegpR9wI:unXPKvC7sMEqPJ9PiyfTq

Malware Config

Extracted

Family

danabot

Botnet

5

C2

23.254.217.192:443

192.236.146.173:443

23.254.133.7:443

185.62.58.85:443

Attributes
  • embedded_hash

    3CCDCA270E94321B76E2E66C454CD541

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 31 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\403DA0C043C2998DA98D36702AF8795548DC51B836BE342D9F2BE808B07D6FB9.exe
    "C:\Users\Admin\AppData\Local\Temp\403DA0C043C2998DA98D36702AF8795548DC51B836BE342D9F2BE808B07D6FB9.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Users\Admin\AppData\Local\Temp\cueVZh.exe
      C:\Users\Admin\AppData\Local\Temp\cueVZh.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\71cc0c58.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4388
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      PID:3792
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 620
      2⤵
      • Program crash
      PID:3400
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 640
      2⤵
      • Program crash
      PID:4780
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 848 -ip 848
    1⤵
      PID:2676
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 848 -ip 848
      1⤵
        PID:1324

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\71cc0c58.bat

        Filesize

        187B

        MD5

        d5b75fb9ac0a086aca4ae6821d6cb929

        SHA1

        206e43815de13786a42c8f42351f31e752d4db98

        SHA256

        87b733a6fa67d096fa89daed7cc713deea5bf414be9eb38a78fb8ae8bb5bb61b

        SHA512

        3a4ff8ec7f88f7589f6cdd504797371cad916ff517eff48594026bf6cffd6bccdc6c251da730e3364e7ddbe15a70d1874f954ff1c4462f59e8268b6492d846dc

      • C:\Users\Admin\AppData\Local\Temp\cueVZh.exe

        Filesize

        15KB

        MD5

        f7d21de5c4e81341eccd280c11ddcc9a

        SHA1

        d4e9ef10d7685d491583c6fa93ae5d9105d815bd

        SHA256

        4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794

        SHA512

        e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

      • memory/848-11-0x0000000000400000-0x0000000000635000-memory.dmp

        Filesize

        2.2MB

      • memory/848-8-0x00000000023A0000-0x0000000002486000-memory.dmp

        Filesize

        920KB

      • memory/848-9-0x0000000002490000-0x00000000026B3000-memory.dmp

        Filesize

        2.1MB

      • memory/848-10-0x0000000000400000-0x0000000000630000-memory.dmp

        Filesize

        2.2MB

      • memory/848-29-0x0000000002490000-0x00000000026B3000-memory.dmp

        Filesize

        2.1MB

      • memory/848-12-0x0000000000400000-0x0000000000635000-memory.dmp

        Filesize

        2.2MB

      • memory/848-13-0x0000000000400000-0x0000000000635000-memory.dmp

        Filesize

        2.2MB

      • memory/848-24-0x0000000000400000-0x0000000000635000-memory.dmp

        Filesize

        2.2MB

      • memory/848-26-0x00000000023A0000-0x0000000002486000-memory.dmp

        Filesize

        920KB

      • memory/848-0-0x0000000000400000-0x0000000000635000-memory.dmp

        Filesize

        2.2MB

      • memory/848-31-0x0000000000400000-0x0000000000630000-memory.dmp

        Filesize

        2.2MB

      • memory/2384-4-0x0000000000A20000-0x0000000000A29000-memory.dmp

        Filesize

        36KB

      • memory/2384-22-0x0000000000A20000-0x0000000000A29000-memory.dmp

        Filesize

        36KB

      • memory/3792-46-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-55-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-18-0x0000000075270000-0x0000000075410000-memory.dmp

        Filesize

        1.6MB

      • memory/3792-27-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-28-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-16-0x00000000752B4000-0x00000000752B5000-memory.dmp

        Filesize

        4KB

      • memory/3792-30-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-14-0x0000000000140000-0x0000000000143000-memory.dmp

        Filesize

        12KB

      • memory/3792-32-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-34-0x00000000752B4000-0x00000000752B5000-memory.dmp

        Filesize

        4KB

      • memory/3792-35-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-36-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-37-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-38-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-40-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-41-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-42-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-43-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-44-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-15-0x00000000773B4000-0x00000000773B5000-memory.dmp

        Filesize

        4KB

      • memory/3792-47-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-48-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-49-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-50-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-52-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-53-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-54-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-17-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-57-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-58-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-59-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-60-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-62-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-63-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-64-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-65-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-67-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-68-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-69-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-70-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-72-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-73-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-74-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-75-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-76-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-78-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-79-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-80-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-81-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-82-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-84-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-85-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-87-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-88-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB

      • memory/3792-89-0x0000000000150000-0x0000000000153000-memory.dmp

        Filesize

        12KB