danabot | 9cbaec7eb2c14ecdc39095c2deae0c20cb42e9f28466307c44f5848de49a58ef

Analysis

max time kernel
293s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

B6F6C74F86A145460F03AC3A0520D3345FC7FCC1.msi
Size

8.9MB
MD5

e1438c21e6de91615a6a5e2a48f274fc
SHA1

b6f6c74f86a145460f03ac3a0520d3345fc7fcc1
SHA256

9cbaec7eb2c14ecdc39095c2deae0c20cb42e9f28466307c44f5848de49a58ef
SHA512

9be5f304259a2bbc488cde3a9a5cf09b2019a14e32538d79e88e3d1785bce5a3dcfca6702d235d5ec87b4bdf043f3c6a41762ccc2ba6fed8ee63366c0f2e0879
SSDEEP

196608:9n520ZroZkRsj6N+gdC1fcmwz/MIpqPuJS8ErZ/0jCi:9n52eSFjG+aAfcRo4Kz8W0j

Score

10^/10

danabot banker discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
5059953BB045843A520147F73664DC78
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Blocklisted process makes network request 6 IoCs

flow	pid	Process
26	1264	rundll32.exe
27	1264	rundll32.exe
38	1264	rundll32.exe
40	1264	rundll32.exe
43	1264	rundll32.exe
75	1264	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI3C79.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D56.tmp	msiexec.exe
File created	C:\Windows\Installer\e583ac6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI43C0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI43C1.tmp	msiexec.exe
File created	C:\Windows\Installer\e583ac2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e583ac2.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B10.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C1B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CB9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{27B611CD-7B17-41F6-B60D-D59C81B6D3AC}	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
732	MSI43C1.tmp
3632	MSI43C0.tmp

Loads dropped DLL 6 IoCs

pid	Process
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
1264	rundll32.exe
1264	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3172	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI43C1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI43C0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4504	msiexec.exe
4504	msiexec.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3172	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3172	msiexec.exe
Token: SeSecurityPrivilege	4504	msiexec.exe
Token: SeCreateTokenPrivilege	3172	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3172	msiexec.exe
Token: SeLockMemoryPrivilege	3172	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3172	msiexec.exe
Token: SeMachineAccountPrivilege	3172	msiexec.exe
Token: SeTcbPrivilege	3172	msiexec.exe
Token: SeSecurityPrivilege	3172	msiexec.exe
Token: SeTakeOwnershipPrivilege	3172	msiexec.exe
Token: SeLoadDriverPrivilege	3172	msiexec.exe
Token: SeSystemProfilePrivilege	3172	msiexec.exe
Token: SeSystemtimePrivilege	3172	msiexec.exe
Token: SeProfSingleProcessPrivilege	3172	msiexec.exe
Token: SeIncBasePriorityPrivilege	3172	msiexec.exe
Token: SeCreatePagefilePrivilege	3172	msiexec.exe
Token: SeCreatePermanentPrivilege	3172	msiexec.exe
Token: SeBackupPrivilege	3172	msiexec.exe
Token: SeRestorePrivilege	3172	msiexec.exe
Token: SeShutdownPrivilege	3172	msiexec.exe
Token: SeDebugPrivilege	3172	msiexec.exe
Token: SeAuditPrivilege	3172	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3172	msiexec.exe
Token: SeChangeNotifyPrivilege	3172	msiexec.exe
Token: SeRemoteShutdownPrivilege	3172	msiexec.exe
Token: SeUndockPrivilege	3172	msiexec.exe
Token: SeSyncAgentPrivilege	3172	msiexec.exe
Token: SeEnableDelegationPrivilege	3172	msiexec.exe
Token: SeManageVolumePrivilege	3172	msiexec.exe
Token: SeImpersonatePrivilege	3172	msiexec.exe
Token: SeCreateGlobalPrivilege	3172	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3172	msiexec.exe
3172	msiexec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe
3404	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 3836	4504	msiexec.exe	89
PID 4504 wrote to memory of 3836	4504	msiexec.exe	89
PID 4504 wrote to memory of 3836	4504	msiexec.exe	89
PID 4504 wrote to memory of 732	4504	msiexec.exe	97
PID 4504 wrote to memory of 732	4504	msiexec.exe	97
PID 4504 wrote to memory of 732	4504	msiexec.exe	97
PID 4504 wrote to memory of 3632	4504	msiexec.exe	98
PID 4504 wrote to memory of 3632	4504	msiexec.exe	98
PID 4504 wrote to memory of 3632	4504	msiexec.exe	98
PID 2416 wrote to memory of 1264	2416	rundll32.exe	101
PID 2416 wrote to memory of 1264	2416	rundll32.exe	101
PID 2416 wrote to memory of 1264	2416	rundll32.exe	101
PID 3404 wrote to memory of 4020	3404	AcroRd32.exe	107
PID 3404 wrote to memory of 4020	3404	AcroRd32.exe	107
PID 3404 wrote to memory of 4020	3404	AcroRd32.exe	107
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4612	4020	RdrCEF.exe	108
PID 4020 wrote to memory of 4692	4020	RdrCEF.exe	109
PID 4020 wrote to memory of 4692	4020	RdrCEF.exe	109
PID 4020 wrote to memory of 4692	4020	RdrCEF.exe	109
PID 4020 wrote to memory of 4692	4020	RdrCEF.exe	109
PID 4020 wrote to memory of 4692	4020	RdrCEF.exe	109
PID 4020 wrote to memory of 4692	4020	RdrCEF.exe	109
PID 4020 wrote to memory of 4692	4020	RdrCEF.exe	109
PID 4020 wrote to memory of 4692	4020	RdrCEF.exe	109

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\B6F6C74F86A145460F03AC3A0520D3345FC7FCC1.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3172

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DBF13A89E86D81D2B33AA42814B429A1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3836
- C:\Windows\Installer\MSI43C1.tmp
  "C:\Windows\Installer\MSI43C1.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\" C:\Windows\System32\rundll32.exe "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\meitneriumatm.dll",muirent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:732
- C:\Windows\Installer\MSI43C0.tmp
  "C:\Windows\Installer\MSI43C0.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\reportsummary.pdf"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3632

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\reportsummary.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9F695162958FD049A413FFC838AB8DAE --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=27E9C9F263F9B39937AD5761D7727FE5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=27E9C9F263F9B39937AD5761D7727FE5 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B3BE673AB7BEEADBD62E5CB8B73BC71A --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:920
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F2AE9042BC765642B727278DFC147649 --mojo-platform-channel-handle=1960 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:392
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D9AE95D5E583C6D2D675A56E92CD8AFA --mojo-platform-channel-handle=1896 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4796

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\meitneriumatm.dll",muirent
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\TypeFasterPortable\meitneriumatm.dll",muirent
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:1264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e583ac5.rbs

Filesize
897KB

MD5
5f1756ee32d45ea54d0850cd0b743c1c

SHA1
2eb9a3fda0d3ecd0a9b69e9ae2a4c5d463a75ff1

SHA256
a5c6d7b721915ed36308b5c2cd6934e2b8054c35e65b3d781ac6e986fe02ab08

SHA512
0e2228a68b8d8dd8e9fd4305a33ba61c0d6e5ba963f5e2bd9e6b998dc9e4cb5dd17eee88bb08333507dcb36ca8d45a79e05fec73849884e43060fbae696c4aa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
819f03238818a02aa4c4e1b78e685a86

SHA1
2a1b923757dbfdcfa3bdf3a195d21fc5f4f797b6

SHA256
74fbffb2e45ec1bf62b016b256894ed1436ad2b0fd3e4e740bfec6266a61e0d6

SHA512
86294090bbc68d506e88abd185d9f0278009f8df01ce6b15d0dbe022c1b5210bcc3765c36bd4fa6ce87dfa401d044038f36a90ac85cce581f36f488e7ffd276d

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\appinfo.ini

Filesize
220B

MD5
660f341fa878ff15b5d6a4d2b6611f27

SHA1
a67647f6b19b3318c6bbe5ff17a5c12b5941d958

SHA256
34ae19c668c6e8bbde710952db333b7cf491238c4a517fe97d03c525866bdb9f

SHA512
60d26599197e014b498cf81670d7ac4386ff2419e54b85aaf63d78823cdcb9208afd68b6506cecbbc8be7f72eb31118ff30aabdedea16248ee778252cb43c79f

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\appinfo.ini

Filesize
421B

MD5
a273175a13e52400ce061eb2bf2dcdc6

SHA1
70245abbf4dcc6dd86f4295435ce168690f62828

SHA256
cf18c44ac149949198858169f8c050fd83f9f59dd03ffdd8691bc0417626689b

SHA512
8eae62bc656dfcc0db18ddec0e3cbbe2e03c50c351927e87e3fc97742cf6dc80ae80ba877fdb4c0e078aed940825ed62214d2f9d8f095ac7eaf1b4fa50c14957

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\appinfo.ini

Filesize
454B

MD5
fcc2f38a47c3d336d618a7119df6054b

SHA1
8b5ff080c4d5947e67227b33a2f1c3069b1a60e5

SHA256
9f510cd085f46706c06acffba8e5c909c5c0950593d864a67b716aff4822cc4b

SHA512
3774f39d308656aea6285a1c5cd7d7f6f4cf2e597e85456c2f979e57aa388dc6698389cbd5f9a8d93e15aa34a8b07e613e8aa6c078e5c958573a6602609e82db

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\pac_installer_log.ini

Filesize
327B

MD5
b2fd2f591942ac6c66d8890c32b1f245

SHA1
913fadbced56b78b7da7c1df4f0ead4f21338bff

SHA256
b504348c5b7d38fea062a4f770f401ea0bc29ac1462680c338932845e5fe62fc

SHA512
184409ee07715da83a19a0b913988c7da3cabccece700a94395cc5c268115c8d89ff41f954cadad3028238b6da8085a99f66f565465c253da36f4e33d48f22d7

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\App\AppInfo\pac_installer_log.ini

Filesize
517B

MD5
e121ba0c25545a869ff1e09988019380

SHA1
4f2725d025c0e1566d899d9f1c87b043eab6fa17

SHA256
6fed00d92593dd975bdec6976c4f297bb37dd3360c9c54288697595c6b3bf1c4

SHA512
aec3b890acd09b680fa43ac162d12eb2931522addd46efb435a14f15fbca7fada79d4f4b461d0ff8a059d11a127b05739d14e2a6cc80b1ff70429a0cec2c1046

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\meitneriumatm.dll

Filesize
7.7MB

MD5
043dae1b817ae561da9d6654b6354696

SHA1
a9f62f9ca8faa6023c4ef755d3b1f5aed2914516

SHA256
9de78011f776d2f3c963c6c3f77bc7af98ac51b4dbd11350850a8416bf767c36

SHA512
b7b44df89e93de8f31a35a22ed7b2d292cbad83ef564281af8e50aedade2f3ed4560b1e2ee9d91a5f1b270c407eafbef0f983895f8ed6651428ec5fe7389198e

Download Submit
C:\Users\Admin\AppData\Roaming\TypeFasterPortable\reportsummary.pdf

Filesize
19B

MD5
138994255ba043be1c37715fd931b1f3

SHA1
a39ed185ae5c91a59f9ae7bddce84cdcccb766cf

SHA256
6df84c79758b9f79709bd9292563dbda3fc7c726180ec6d394dd4e54b4427beb

SHA512
b26f7ea2c106852044b3a014ea91555a50ba43d4305a61c796926718da78d7dce335e9bb9613f0275ede4c961cc49f9a38e4bd59cc1504ba28457b364e3ee0cc

Download Submit
C:\Windows\Installer\MSI3B10.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI43C1.tmp

Filesize
418KB

MD5
dd31c60eedf38fe4704ac9293614afee

SHA1
48b7ad49bfcba2906834324548e731729ead34bc

SHA256
6e8b9a6e7497d88421fa446ec1c2312fcf61d7f340364c61bd02b0bb4684b94f

SHA512
66f4642b3c0a92c2fc8e7cc7d0a61e7132d5193b90b7d4b2554a4a7bfff0fd990b47157d1f2af05ed177dc7dc920984f56b81e114e17de389d20fa5e51fa19e9

Download Submit
C:\Windows\Installer\e583ac2.msi

Filesize
8.9MB

MD5
e1438c21e6de91615a6a5e2a48f274fc

SHA1
b6f6c74f86a145460f03ac3a0520d3345fc7fcc1

SHA256
9cbaec7eb2c14ecdc39095c2deae0c20cb42e9f28466307c44f5848de49a58ef

SHA512
9be5f304259a2bbc488cde3a9a5cf09b2019a14e32538d79e88e3d1785bce5a3dcfca6702d235d5ec87b4bdf043f3c6a41762ccc2ba6fed8ee63366c0f2e0879

Download Submit
memory/1264-577-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-575-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-564-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-574-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-562-0x0000000003F10000-0x0000000003F11000-memory.dmp

Filesize
4KB

Download
memory/1264-581-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-579-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-580-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-583-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-582-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-576-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-563-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-578-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-573-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-584-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-585-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-608-0x00000000021C0000-0x000000000298C000-memory.dmp

Filesize
7.8MB

Download
memory/1264-561-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-552-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/1264-540-0x00000000021C0000-0x000000000298C000-memory.dmp

Filesize
7.8MB

Download
memory/1264-704-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download
memory/1264-705-0x0000000003160000-0x0000000003CAB000-memory.dmp

Filesize
11.3MB

Download