Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24-07-2024 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe
Resource
win7-20240705-en
windows7-x64
9 signatures
150 seconds
General
-
Target
9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe
-
Size
1.1MB
-
MD5
68861f3f1f2928c83b8203e7c45bedc2
-
SHA1
6c410f8ac0deb98d2a682b63a7f26c791a3a6dd7
-
SHA256
749c23656b53bfd0ec3609f16ad0198fc38e5af9af1826820e4133cb88f9ec97
-
SHA512
f9a1dbaaf10919ea61413d1ed6b28d7768fadfcb8d863a4417b5512fd085f70324a40853d3c78a58adf6fdacbb4c9d6670adf365c853000da00064fdccdf971a
-
SSDEEP
24576:ovJqlPrBW4AvDvS0wpT8AoJ92oZgFO037cs:o2jI4AvjGpbSE3os
Malware Config
Extracted
Family
danabot
Botnet
5
C2
23.254.217.192:443
192.236.146.173:443
23.254.133.7:443
185.62.58.85:443
Attributes
-
embedded_hash
3CCDCA270E94321B76E2E66C454CD541
-
type
loader
Signatures
-
Blocklisted process makes network request 50 IoCs
Processes:
rundll32.exeflow pid Process 7 2232 rundll32.exe 13 2232 rundll32.exe 15 2232 rundll32.exe 16 2232 rundll32.exe 17 2232 rundll32.exe 18 2232 rundll32.exe 19 2232 rundll32.exe 20 2232 rundll32.exe 21 2232 rundll32.exe 22 2232 rundll32.exe 23 2232 rundll32.exe 24 2232 rundll32.exe 25 2232 rundll32.exe 26 2232 rundll32.exe 27 2232 rundll32.exe 28 2232 rundll32.exe 29 2232 rundll32.exe 30 2232 rundll32.exe 31 2232 rundll32.exe 32 2232 rundll32.exe 33 2232 rundll32.exe 34 2232 rundll32.exe 35 2232 rundll32.exe 36 2232 rundll32.exe 37 2232 rundll32.exe 38 2232 rundll32.exe 39 2232 rundll32.exe 40 2232 rundll32.exe 41 2232 rundll32.exe 42 2232 rundll32.exe 43 2232 rundll32.exe 44 2232 rundll32.exe 45 2232 rundll32.exe 46 2232 rundll32.exe 47 2232 rundll32.exe 48 2232 rundll32.exe 49 2232 rundll32.exe 50 2232 rundll32.exe 51 2232 rundll32.exe 52 2232 rundll32.exe 53 2232 rundll32.exe 54 2232 rundll32.exe 55 2232 rundll32.exe 56 2232 rundll32.exe 57 2232 rundll32.exe 58 2232 rundll32.exe 59 2232 rundll32.exe 60 2232 rundll32.exe 61 2232 rundll32.exe 62 2232 rundll32.exe -
Processes:
resource yara_rule behavioral1/files/0x000d00000001224d-7.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
EuKtQuR.exepid Process 2580 EuKtQuR.exe -
Loads dropped DLL 2 IoCs
Processes:
9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exepid Process 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe -
Drops file in Program Files directory 64 IoCs
Processes:
EuKtQuR.exedescription ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe EuKtQuR.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE EuKtQuR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE EuKtQuR.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE EuKtQuR.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe EuKtQuR.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe EuKtQuR.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe EuKtQuR.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe EuKtQuR.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe EuKtQuR.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe EuKtQuR.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe EuKtQuR.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe EuKtQuR.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE EuKtQuR.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe EuKtQuR.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE EuKtQuR.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE EuKtQuR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE EuKtQuR.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe EuKtQuR.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe EuKtQuR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE EuKtQuR.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe EuKtQuR.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe EuKtQuR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe EuKtQuR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exerundll32.exeEuKtQuR.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EuKtQuR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exeEuKtQuR.exedescription pid Process procid_target PID 1688 wrote to memory of 2580 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 30 PID 1688 wrote to memory of 2580 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 30 PID 1688 wrote to memory of 2580 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 30 PID 1688 wrote to memory of 2580 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 30 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 1688 wrote to memory of 2232 1688 9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe 31 PID 2580 wrote to memory of 824 2580 EuKtQuR.exe 34 PID 2580 wrote to memory of 824 2580 EuKtQuR.exe 34 PID 2580 wrote to memory of 824 2580 EuKtQuR.exe 34 PID 2580 wrote to memory of 824 2580 EuKtQuR.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe"C:\Users\Admin\AppData\Local\Temp\9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\EuKtQuR.exeC:\Users\Admin\AppData\Local\Temp\EuKtQuR.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\25f62638.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:824
-
-
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VX38S3F\k2[1].rar
Filesize4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
189B
MD5bc62d8102d75bbdd456877a0653899f7
SHA1d97fcebf5ae9a29051166bd5a3b9e68a9f6e8b1b
SHA256c4377594241188e51186c56ed2c6b7e051b8ec770c340e234e766d096f9833e9
SHA51218e70231f816d5ea05741bddc5cd6f6882ef1fe686a91b25109c18d9b18764c98aaf4dbecc774b1425664b8133ee95bcd70094aa97714064c30773a465d4c45a
-
Filesize
15KB
MD5f7d21de5c4e81341eccd280c11ddcc9a
SHA1d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA2564485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3