Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/07/2024, 13:33

General

  • Target

    6acc0714d3cbab8c42b03d03044f0c56134ed9a651bd1f7a88d8c8f56c978f6a.exe

  • Size

    1.1MB

  • MD5

    fa43013cb8f1c2548f1ae8e73ff602ab

  • SHA1

    6ff459d4c88b399c0f54c83659188380a322bb99

  • SHA256

    6acc0714d3cbab8c42b03d03044f0c56134ed9a651bd1f7a88d8c8f56c978f6a

  • SHA512

    acb3b6c8629d875d05740d0307a42758c49bd288e342f5fefe38056053104a8616fca73f9a6b94f2ef93be2e043bec2edf1c9e165249824f65c8e8ec56e5e297

  • SSDEEP

    24576:uzjX1tNkven7slbDiEqVSwJ9PioVFYKvWegpR9wI:unXPKvC7sMEqPJ9PiyfTq

Malware Config

Extracted

Family

danabot

Botnet

5

C2

23.254.217.192:443

192.236.146.173:443

23.254.133.7:443

185.62.58.85:443

Attributes
  • embedded_hash

    3CCDCA270E94321B76E2E66C454CD541

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 33 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6acc0714d3cbab8c42b03d03044f0c56134ed9a651bd1f7a88d8c8f56c978f6a.exe
    "C:\Users\Admin\AppData\Local\Temp\6acc0714d3cbab8c42b03d03044f0c56134ed9a651bd1f7a88d8c8f56c978f6a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Users\Admin\AppData\Local\Temp\cueVZh.exe
      C:\Users\Admin\AppData\Local\Temp\cueVZh.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\28e70bdb.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3732
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4928
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 556
        3⤵
        • Program crash
        PID:1476
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 624
      2⤵
      • Program crash
      PID:4404
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      PID:1696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 644
      2⤵
      • Program crash
      PID:1964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2680 -ip 2680
    1⤵
      PID:1500
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4928 -ip 4928
      1⤵
        PID:4444
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2680 -ip 2680
        1⤵
          PID:4408

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3WWFCFW4\k2[1].rar

          Filesize

          4B

          MD5

          d3b07384d113edec49eaa6238ad5ff00

          SHA1

          f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

          SHA256

          b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

          SHA512

          0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

        • C:\Users\Admin\AppData\Local\Temp\28e70bdb.bat

          Filesize

          187B

          MD5

          6b5b2cc2e0082307da81645df65faaf0

          SHA1

          db7f70a9703a13f5f96da14eefe69b8ffc46b157

          SHA256

          b68e4f81e9db962ad9614482861172332ca45a93fadb8d9634b756c81f9228ed

          SHA512

          e081766b19c4cf4297139766d93b60c733dc68a058800f52d3ea37784245862bd9b79ada408a4b8b5ac0325933ef8f8ccaf4896570585ce4ba922508b556d99c

        • C:\Users\Admin\AppData\Local\Temp\503C52D8.exe

          Filesize

          4B

          MD5

          20879c987e2f9a916e578386d499f629

          SHA1

          c7b33ddcc42361fdb847036fc07e880b81935d5d

          SHA256

          9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

          SHA512

          bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

        • C:\Users\Admin\AppData\Local\Temp\cueVZh.exe

          Filesize

          15KB

          MD5

          f7d21de5c4e81341eccd280c11ddcc9a

          SHA1

          d4e9ef10d7685d491583c6fa93ae5d9105d815bd

          SHA256

          4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794

          SHA512

          e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

        • memory/1696-86-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-58-0x0000000000500000-0x0000000000502000-memory.dmp

          Filesize

          8KB

        • memory/1696-129-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-128-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-127-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-126-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-89-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-124-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-123-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-91-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-59-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-64-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-63-0x0000000000540000-0x0000000000542000-memory.dmp

          Filesize

          8KB

        • memory/1696-62-0x0000000000530000-0x0000000000532000-memory.dmp

          Filesize

          8KB

        • memory/1696-61-0x0000000000520000-0x0000000000522000-memory.dmp

          Filesize

          8KB

        • memory/1696-60-0x0000000000510000-0x0000000000512000-memory.dmp

          Filesize

          8KB

        • memory/1696-66-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-122-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-68-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-70-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-121-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-72-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-120-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-74-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-75-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-76-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-78-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-81-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-82-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-83-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-84-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-85-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-119-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-88-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-117-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-96-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-116-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-92-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-94-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-95-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-90-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-97-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-99-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-100-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-102-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-103-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-104-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-105-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-106-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-108-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-109-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-110-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-111-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-112-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-114-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/1696-115-0x0000000000550000-0x0000000000552000-memory.dmp

          Filesize

          8KB

        • memory/2680-33-0x0000000000400000-0x0000000000635000-memory.dmp

          Filesize

          2.2MB

        • memory/2680-22-0x0000000002380000-0x000000000245E000-memory.dmp

          Filesize

          888KB

        • memory/2680-0-0x0000000000400000-0x0000000000635000-memory.dmp

          Filesize

          2.2MB

        • memory/2680-73-0x0000000000400000-0x0000000000630000-memory.dmp

          Filesize

          2.2MB

        • memory/2680-71-0x0000000002380000-0x000000000245E000-memory.dmp

          Filesize

          888KB

        • memory/2680-24-0x0000000000400000-0x0000000000630000-memory.dmp

          Filesize

          2.2MB

        • memory/2680-34-0x0000000000400000-0x0000000000635000-memory.dmp

          Filesize

          2.2MB

        • memory/2680-67-0x0000000000400000-0x0000000000635000-memory.dmp

          Filesize

          2.2MB

        • memory/2680-35-0x0000000000400000-0x0000000000635000-memory.dmp

          Filesize

          2.2MB

        • memory/2680-23-0x0000000002460000-0x0000000002683000-memory.dmp

          Filesize

          2.1MB

        • memory/3452-4-0x0000000000520000-0x0000000000529000-memory.dmp

          Filesize

          36KB

        • memory/3452-56-0x0000000000520000-0x0000000000529000-memory.dmp

          Filesize

          36KB

        • memory/4928-52-0x00000000774A4000-0x00000000774A5000-memory.dmp

          Filesize

          4KB

        • memory/4928-53-0x0000000001270000-0x0000000001273000-memory.dmp

          Filesize

          12KB