Managed XDR

vtdl_1780381238_mjrwhgiy (DanaBot) — malware analysis report

File info

Filename
vtdl_1780381238_mjrwhgiy
File type
PE32 executable (GUI) Intel 80386, for MS Windows
File size
4.9 MB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
fef700dcf50b6208193d97d676cf192f8b2916de
SHA256
44b60ec0c0b51b34de6d920361f46995c94eff48c421fd300f949c10e1ff4043
MD5
1e474cb4e77016c68803a44f47d4ef21

Malwares

  • DanaBot

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1140 decompress_pefile: Unpacks a PE file into memory
T1027.002 unnamed_memory_regions_contains_pe: One or several unnamed memory regions are PE files
T1027.002 decompress_pefile: Unpacks a PE file into memory
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1480 system_default_lang_id_present: Checks the system language
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization

Credential Access

T1552 infostealer_browser: Retrieves personal information from local Internet browsers
T1503 infostealer_browser: Retrieves personal information from local Internet browsers
T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1518 recon_programs: Collects information about installed programs
T1518 locates_browser: Attempts to identify where browsers are installed
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization

Command and Control

T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Impact

T1486 modifies_files2: Cryptolocker indicators detected (50 or more files are modified)

Other

yara_rules: Static rules
network_bind: Starts servers listening at 127.0.0.1:3683, None
creates_exe: Creates executable files in the file system
dead_host: Connects to IP addresses that do not respond to requests
creates_suspended_process: Creates suspended process
break_limit_exceeded: Warning: function calls limit has been exceeded
suspicious_network_port: Performs TCP or UDP request to non-standard port
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call

Related reports

Managed XDR