Analysis date (UTC): 14 February 2024, 17:35Analysis environment: Windows 10 Pro, build 19044, x64

allegato_708.js

MD5:5DAF53BF848BB4CDA008A655BDECF425

SHA1:422EDA5A133D4BD324C634F113639A57C38BB552

SHA256:847B4AD90B1DABA2D9117A8E05776F3F902DDA593FB1252289538ACF476C4268

Analysis result

Threat level:Malicious activity

Tags:

loaderdanabotdanabot-unpackedstealer

Full analysis:Analysis allegato_708.js (MD5: 5DAF53BF848BB4CDA008A655BDECF425) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Gets path to any of the special folders (SCRIPT)

wscript.exe (PID: 1156)

Opens an HTTP connection (SCRIPT)

wscript.exe (PID: 1156)

Drops the executable file immediately after the start

wscript.exe (PID: 1156)

Scans artifacts that could help determine the target

wscript.exe (PID: 1156)

Creates internet connection object (SCRIPT)

wscript.exe (PID: 1156)

Unusual connection from system programs

wscript.exe (PID: 1156)
rundll32.exe (PID: 1816)

Sends HTTP request (SCRIPT)

wscript.exe (PID: 1156)

Change Internet Settings

rundll32.exe (PID: 1816)

DANABOT has been detected (SURICATA)

rundll32.exe (PID: 1816)

DANABOT has been detected (YARA)

rundll32.exe (PID: 1816)

Steals credentials from Web Browsers

rundll32.exe (PID: 1816)

Actions looks like stealing of personal data

rundll32.exe (PID: 1816)

SUSPICIOUS

Writes binary data to a Stream object (SCRIPT)

wscript.exe (PID: 1156)

Process requests binary or script from the Internet

wscript.exe (PID: 1156)

Creates FileSystem object to access computer's file system (SCRIPT)

wscript.exe (PID: 1156)

Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

wscript.exe (PID: 1156)

Saves data to a binary file (SCRIPT)

wscript.exe (PID: 1156)

Executable content was dropped or overwritten

wscript.exe (PID: 1156)

Uses RUNDLL32.EXE to load library

wscript.exe (PID: 1156)

Searches for installed software

rundll32.exe (PID: 1816)

The process verifies whether the antivirus software is installed

rundll32.exe (PID: 1816)

INFO

Checks proxy server information

wscript.exe (PID: 1156)
rundll32.exe (PID: 1816)
slui.exe (PID: 1576)

Reads security settings of Internet Explorer

rundll32.exe (PID: 1816)

Reads Windows Product ID

rundll32.exe (PID: 1816)

Create files in a temporary directory

rundll32.exe (PID: 1816)

Reads Microsoft Office registry keys

rundll32.exe (PID: 1816)

Reads the software policy settings

slui.exe (PID: 1576)

Creates files in the program directory

rundll32.exe (PID: 1816)

Threats

PID	Process	Class	Message
2136	svchost.exe	Potentially Bad Traffic	ET DNS Query to a *.top domain - Likely Hostile
1156	wscript.exe	Potentially Bad Traffic	ET INFO HTTP Request to a *.top domain
1156	wscript.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
1156	wscript.exe	Misc activity	ET HUNTING Possible EXE Download From Suspicious TLD
1816	rundll32.exe	Malware Command and Control Activity Detected	STEALER [ANY.RUN] Danabot
1816	rundll32.exe	Malware Command and Control Activity Detected	STEALER [ANY.RUN] Danabot
1816	rundll32.exe	Malware Command and Control Activity Detected	STEALER [ANY.RUN] Danabot
1816	rundll32.exe	Malware Command and Control Activity Detected	STEALER [ANY.RUN] Danabot