General
-
Target
sample
-
Size
169KB
-
Sample
240611-jv697azcmh
-
MD5
a957582bd5371c69795bd1c2ee73a042
-
SHA1
d725b7f30bbb1eda943cf992a23db6d36a4be505
-
SHA256
07b224d0aee012bdfedea8fb860f93d091fb4c1a2d6d581e7620570fa2a4e3fd
-
SHA512
334244a1a6fae10a779c1b66a74da2263e77a3beaa8075e82254331992fdc68bd54fc5167d07d4b9015f71e198b701f66bdcf24bf8c271c282070836d7d450c3
-
SSDEEP
3072:PagocDBgWgjiiiyR22pwTEGuCisou6U2ekT+twq+k+twq2k+twqhk4twqck+twql:P/BEGuCisou6U2ekT+twq+k+twq2k+tu
Static task
static1
Behavioral task
behavioral1
Sample
sample.js
Resource
win10v2004-20240426-en
Malware Config
Extracted
http://93.115.82.248/?0=1&1=1&2=9&3=i&4=9200&5=1&6=1111&7=piaatcpisj
Extracted
danabot
51.178.195.151
51.222.39.81
149.255.35.125
38.68.50.179
51.77.7.204
Targets
-
-
Target
sample
-
Size
169KB
-
MD5
a957582bd5371c69795bd1c2ee73a042
-
SHA1
d725b7f30bbb1eda943cf992a23db6d36a4be505
-
SHA256
07b224d0aee012bdfedea8fb860f93d091fb4c1a2d6d581e7620570fa2a4e3fd
-
SHA512
334244a1a6fae10a779c1b66a74da2263e77a3beaa8075e82254331992fdc68bd54fc5167d07d4b9015f71e198b701f66bdcf24bf8c271c282070836d7d450c3
-
SSDEEP
3072:PagocDBgWgjiiiyR22pwTEGuCisou6U2ekT+twq+k+twq2k+twqhk4twqck+twql:P/BEGuCisou6U2ekT+twq+k+twq2k+tu
-
Modifies WinLogon for persistence
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1