danabot | 9cbaec7eb2c14ecdc39095c2deae0c20cb42e9f28466307c44f5848de49a58ef

Analysis

max time kernel
295s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

B6F6C74F86A145460F03AC3A0520D3345FC7FCC1.msi
Size

8.9MB
MD5

e1438c21e6de91615a6a5e2a48f274fc
SHA1

b6f6c74f86a145460f03ac3a0520d3345fc7fcc1
SHA256

9cbaec7eb2c14ecdc39095c2deae0c20cb42e9f28466307c44f5848de49a58ef
SHA512

9be5f304259a2bbc488cde3a9a5cf09b2019a14e32538d79e88e3d1785bce5a3dcfca6702d235d5ec87b4bdf043f3c6a41762ccc2ba6fed8ee63366c0f2e0879
SSDEEP

196608:9n520ZroZkRsj6N+gdC1fcmwz/MIpqPuJS8ErZ/0jCi:9n52eSFjG+aAfcRo4Kz8W0j

Score

10^/10

danabot banker discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
5059953BB045843A520147F73664DC78
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Blocklisted process makes network request 7 IoCs

flow	pid	Process
28	920	rundll32.exe
30	920	rundll32.exe
40	920	rundll32.exe
44	920	rundll32.exe
48	920	rundll32.exe
69	920	rundll32.exe
79	920	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAD8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57be7d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEDB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC17C.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{27B611CD-7B17-41F6-B60D-D59C81B6D3AC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2F6.tmp	msiexec.exe
File created	C:\Windows\Installer\e57be81.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAD7.tmp	msiexec.exe
File created	C:\Windows\Installer\e57be7d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC23A.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4996	MSICAD8.tmp
1464	MSICAD7.tmp

Loads dropped DLL 6 IoCs

pid	Process
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
2296	MsiExec.exe
920	rundll32.exe
920	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2912	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSICAD7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSICAD8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1828	msiexec.exe
1828	msiexec.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2912	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2912	msiexec.exe
Token: SeSecurityPrivilege	1828	msiexec.exe
Token: SeCreateTokenPrivilege	2912	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2912	msiexec.exe
Token: SeLockMemoryPrivilege	2912	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2912	msiexec.exe
Token: SeMachineAccountPrivilege	2912	msiexec.exe
Token: SeTcbPrivilege	2912	msiexec.exe
Token: SeSecurityPrivilege	2912	msiexec.exe
Token: SeTakeOwnershipPrivilege	2912	msiexec.exe
Token: SeLoadDriverPrivilege	2912	msiexec.exe
Token: SeSystemProfilePrivilege	2912	msiexec.exe
Token: SeSystemtimePrivilege	2912	msiexec.exe
Token: SeProfSingleProcessPrivilege	2912	msiexec.exe
Token: SeIncBasePriorityPrivilege	2912	msiexec.exe
Token: SeCreatePagefilePrivilege	2912	msiexec.exe
Token: SeCreatePermanentPrivilege	2912	msiexec.exe
Token: SeBackupPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	2912	msiexec.exe
Token: SeShutdownPrivilege	2912	msiexec.exe
Token: SeDebugPrivilege	2912	msiexec.exe
Token: SeAuditPrivilege	2912	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2912	msiexec.exe
Token: SeChangeNotifyPrivilege	2912	msiexec.exe
Token: SeRemoteShutdownPrivilege	2912	msiexec.exe
Token: SeUndockPrivilege	2912	msiexec.exe
Token: SeSyncAgentPrivilege	2912	msiexec.exe
Token: SeEnableDelegationPrivilege	2912	msiexec.exe
Token: SeManageVolumePrivilege	2912	msiexec.exe
Token: SeImpersonatePrivilege	2912	msiexec.exe
Token: SeCreateGlobalPrivilege	2912	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2912	msiexec.exe
2912	msiexec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2296	1828	msiexec.exe	87
PID 1828 wrote to memory of 2296	1828	msiexec.exe	87
PID 1828 wrote to memory of 2296	1828	msiexec.exe	87
PID 1828 wrote to memory of 1464	1828	msiexec.exe	93
PID 1828 wrote to memory of 1464	1828	msiexec.exe	93
PID 1828 wrote to memory of 1464	1828	msiexec.exe	93
PID 1828 wrote to memory of 4996	1828	msiexec.exe	92
PID 1828 wrote to memory of 4996	1828	msiexec.exe	92
PID 1828 wrote to memory of 4996	1828	msiexec.exe	92
PID 2704 wrote to memory of 920	2704	rundll32.exe	98
PID 2704 wrote to memory of 920	2704	rundll32.exe	98
PID 2704 wrote to memory of 920	2704	rundll32.exe	98
PID 4512 wrote to memory of 3044	4512	AcroRd32.exe	103
PID 4512 wrote to memory of 3044	4512	AcroRd32.exe	103
PID 4512 wrote to memory of 3044	4512	AcroRd32.exe	103
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 2680	3044	RdrCEF.exe	104
PID 3044 wrote to memory of 3912	3044	RdrCEF.exe	105
PID 3044 wrote to memory of 3912	3044	RdrCEF.exe	105
PID 3044 wrote to memory of 3912	3044	RdrCEF.exe	105
PID 3044 wrote to memory of 3912	3044	RdrCEF.exe	105
PID 3044 wrote to memory of 3912	3044	RdrCEF.exe	105
PID 3044 wrote to memory of 3912	3044	RdrCEF.exe	105
PID 3044 wrote to memory of 3912	3044	RdrCEF.exe	105
PID 3044 wrote to memory of 3912	3044	RdrCEF.exe	105

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\B6F6C74F86A145460F03AC3A0520D3345FC7FCC1.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2912

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6398EAE28F59C76C933546FD4AE3549B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2296
- C:\Windows\Installer\MSICAD8.tmp
  "C:\Windows\Installer\MSICAD8.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\" C:\Windows\System32\rundll32.exe "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\meitneriumatm.dll",muirent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4996
- C:\Windows\Installer\MSICAD7.tmp
  "C:\Windows\Installer\MSICAD7.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\reportsummary.pdf"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1464

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\reportsummary.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=98B0BFAC0E7647D55AE429EB224EB566 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2680
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=07300D86AC19116C5932F3B48F028C5D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=07300D86AC19116C5932F3B48F028C5D --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C99DADEE7207EDDE9F36DCB2C5025AAC --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2776
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=14979992EA3CE715E8FA7EE1A7C9BC53 --mojo-platform-channel-handle=1844 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3604
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8293543FAD98673C2F0B3B8A5F96F657 --mojo-platform-channel-handle=2356 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4160

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\meitneriumatm.dll",muirent
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\meitneriumatm.dll",muirent
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57be80.rbs

Filesize
897KB

MD5
3a38e9d34bf8129faf09bd6e33bad3d4

SHA1
62e0fda4c58eb897d19bbbf82d91dd3defb4f2d7

SHA256
759bee370fedfdc985c20c151796c0d28e764c906bd8c627421395f095015843

SHA512
115a50e1ee530fb01c1cedfbcb573acb11af0d3d198e1135193c70d2b46c5ce57111691fe206db877f647def17db4c9ebc1e035685a9435591ab11d545c8d8a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
c26ed30e7d5ab440480838636efc41db

SHA1
c66e0d00b56abebfb60d2fcc5cf85ad31a0d6591

SHA256
6a3c5c4a8e57f77ecc22078fbf603ecc31fb82d429bd87b7b4b9261447092aef

SHA512
96cdb78bca3e01d4513c31661987e5646e6a8ff24708918aa0d66dfa3ca5d98af4862c9f38c4f41f933c345d2d3adfb1d34d1430b33f45f916f41a9872a030df

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
e9f19ac7fe8b751a68d48763d5f9b1a5

SHA1
b8122bee3415d30210cd885f0ebb7560c9c9ff2a

SHA256
4579a3c321d2ef99545e631d018901bee3aaf1583ce18a704ba1ff00ab081d0d

SHA512
72dc850f4189e0febb77740ea3c26e01cecf3ddbb73c4383a270e77dc11d63711381baf52aec5ce0961119762792ef01c271db1fb1518de4d4ae27c672b3818b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20250217151311.log

Filesize
15KB

MD5
79b1c0d3bac5459c645c0b9d3a5e48a8

SHA1
8c495140396f98971954c5def46bf3ecd5749e8a

SHA256
ade4f99e28c95f25ca6ab0f44a7ecaae2bb98a0561c92e7849c838c12f24ea2f

SHA512
b7c1da85de6f2a569dfa67904d68703c181044b0a80aaa05c392533393c5ccdd394e5f476d27ee951bb480e456e70d39c8cfed394244ff4b270d346bb714e58c

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Filesize
1KB

MD5
5943b8c3749b33e74c172ba619df1719

SHA1
047d52e0a6bb15fd9d9772558a0f8e9f31fe6639

SHA256
323bebd4e67021a210e22ce61fb9fd2be998a1801a2a70b73e827c818a1bab45

SHA512
81116cbd83cc68ddaf29890655b1ee4bee6d779b8fae4580482341f1ddd5613d8e66bfdd99d75412aaa369c9734a8f0aea1b07888e01a8910f2a9a9fafeef9f2

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\Launcher\TypeFasterPortable.ini

Filesize
93B

MD5
f9186b93e2ae8b298b2e6297c052e62b

SHA1
de07e38fb4d6e104ce47895f4116691bacd56e17

SHA256
091e3fc55b8bc2ebf9ca278b34c355fc005b209e9370efdcbd87028cb5b1c1a4

SHA512
d40383cf7b3fbc29087ba9a4277c7efc271aa86de8300a9085ce1bed011f420f3d362f6c2d0b221143555c6c26eeb6ae999314f2925415d22a396ca7a2eabaa1

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\appinfo.ini

Filesize
113B

MD5
2a751a410d85aca0bfd4fb14620dc46d

SHA1
d3f75a14aed0ed081638b5b52df5d1410921ebf0

SHA256
0c4ebf82e8e57a90358db0efa5dc721f7a007fdc1a11e4cd96564b07d39fbe8d

SHA512
e2639c258cd1a8785e2fa3bef426d297f5583aee947d47353362f7827419e1a8c9f856ed477cc8b1c8c99a8a69956f5c9aa63ad8971b657753a1649c4662f332

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\appinfo.ini

Filesize
220B

MD5
660f341fa878ff15b5d6a4d2b6611f27

SHA1
a67647f6b19b3318c6bbe5ff17a5c12b5941d958

SHA256
34ae19c668c6e8bbde710952db333b7cf491238c4a517fe97d03c525866bdb9f

SHA512
60d26599197e014b498cf81670d7ac4386ff2419e54b85aaf63d78823cdcb9208afd68b6506cecbbc8be7f72eb31118ff30aabdedea16248ee778252cb43c79f

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\appinfo.ini

Filesize
506B

MD5
92e001b080fbff760048c06fc997343e

SHA1
a6bceb0fbf356aebc37ab7049bbf3f7ff9aae238

SHA256
3fc2a187e6fa4994ad6994fd4ec5b8241d33b01eff3a2fceaaa6a0fa5596fe15

SHA512
c1ea92f85eb42505a44bdae5ce458f7ea0e074ccf3352f12f15f54cd43dcd7d0956ca531f0b779b9b8395e875d1a5b93d69c80a3d6010d8bce01c0697fdfca56

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\pac_installer_log.ini

Filesize
551B

MD5
9afa4d76710c10fccd6769fa23b5b695

SHA1
b10f230a298e0cca3353ee3385f06a41194dca7d

SHA256
ff25900b37e613614d57aec89d8286291b6256bac56e90bbfcb5f1cd3d843807

SHA512
05cdfb9319eb4145f6c663d8383e50116bd98eb905855a8f90ce695c3a5cfb46dcd31b40c5b2794d64dbed4a308f1c67d659365980383d43774ac3c6583cc777

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\meitneriumatm.dll

Filesize
7.7MB

MD5
043dae1b817ae561da9d6654b6354696

SHA1
a9f62f9ca8faa6023c4ef755d3b1f5aed2914516

SHA256
9de78011f776d2f3c963c6c3f77bc7af98ac51b4dbd11350850a8416bf767c36

SHA512
b7b44df89e93de8f31a35a22ed7b2d292cbad83ef564281af8e50aedade2f3ed4560b1e2ee9d91a5f1b270c407eafbef0f983895f8ed6651428ec5fe7389198e

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\reportsummary.pdf

Filesize
19B

MD5
138994255ba043be1c37715fd931b1f3

SHA1
a39ed185ae5c91a59f9ae7bddce84cdcccb766cf

SHA256
6df84c79758b9f79709bd9292563dbda3fc7c726180ec6d394dd4e54b4427beb

SHA512
b26f7ea2c106852044b3a014ea91555a50ba43d4305a61c796926718da78d7dce335e9bb9613f0275ede4c961cc49f9a38e4bd59cc1504ba28457b364e3ee0cc

Download Submit
C:\Windows\Installer\MSIBEDB.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSICAD7.tmp

Filesize
418KB

MD5
dd31c60eedf38fe4704ac9293614afee

SHA1
48b7ad49bfcba2906834324548e731729ead34bc

SHA256
6e8b9a6e7497d88421fa446ec1c2312fcf61d7f340364c61bd02b0bb4684b94f

SHA512
66f4642b3c0a92c2fc8e7cc7d0a61e7132d5193b90b7d4b2554a4a7bfff0fd990b47157d1f2af05ed177dc7dc920984f56b81e114e17de389d20fa5e51fa19e9

Download Submit
C:\Windows\Installer\e57be7d.msi

Filesize
8.9MB

MD5
e1438c21e6de91615a6a5e2a48f274fc

SHA1
b6f6c74f86a145460f03ac3a0520d3345fc7fcc1

SHA256
9cbaec7eb2c14ecdc39095c2deae0c20cb42e9f28466307c44f5848de49a58ef

SHA512
9be5f304259a2bbc488cde3a9a5cf09b2019a14e32538d79e88e3d1785bce5a3dcfca6702d235d5ec87b4bdf043f3c6a41762ccc2ba6fed8ee63366c0f2e0879

Download Submit
memory/920-604-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-602-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-583-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/920-606-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-609-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-610-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-611-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-607-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-608-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-603-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-585-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-584-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-605-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-612-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-613-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-614-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-638-0x0000000002630000-0x0000000002DFC000-memory.dmp

Filesize
7.8MB

Download
memory/920-582-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-552-0x0000000003050000-0x0000000003051000-memory.dmp

Filesize
4KB

Download
memory/920-541-0x0000000002630000-0x0000000002DFC000-memory.dmp

Filesize
7.8MB

Download
memory/920-736-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download
memory/920-737-0x0000000003580000-0x00000000040CB000-memory.dmp

Filesize
11.3MB

Download