Analysis date (UTC): 14 February 2024, 22:37Analysis environment: Windows 7 Pro, build 7601, x86

allegato_708.js

MD5:5DAF53BF848BB4CDA008A655BDECF425

SHA1:422EDA5A133D4BD324C634F113639A57C38BB552

SHA256:847B4AD90B1DABA2D9117A8E05776F3F902DDA593FB1252289538ACF476C4268

Analysis result

Threat level:Malicious activity

Tags:

loaderdanabotdanabot-unpackedstealer

Full analysis:Analysis allegato_708.js (MD5: 5DAF53BF848BB4CDA008A655BDECF425) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Gets path to any of the special folders (SCRIPT)

wscript.exe (PID: 3672)

Opens an HTTP connection (SCRIPT)

wscript.exe (PID: 3672)

Creates internet connection object (SCRIPT)

wscript.exe (PID: 3672)

Unusual connection from system programs

wscript.exe (PID: 3672)
rundll32.exe (PID: 3304)

Sends HTTP request (SCRIPT)

wscript.exe (PID: 3672)

Drops the executable file immediately after the start

wscript.exe (PID: 3672)

Steals credentials

rundll32.exe (PID: 3304)

Steals credentials from Web Browsers

rundll32.exe (PID: 3304)
taskhost.exe (PID: 2064)

DANABOT has been detected (SURICATA)

rundll32.exe (PID: 3304)

DANABOT has been detected (YARA)

rundll32.exe (PID: 3304)

Actions looks like stealing of personal data

rundll32.exe (PID: 3304)

SUSPICIOUS

Creates FileSystem object to access computer's file system (SCRIPT)

wscript.exe (PID: 3672)

Reads the Internet Settings

wscript.exe (PID: 3672)
rundll32.exe (PID: 3304)
taskhost.exe (PID: 2064)

Executable content was dropped or overwritten

wscript.exe (PID: 3672)

Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

wscript.exe (PID: 3672)

Saves data to a binary file (SCRIPT)

wscript.exe (PID: 3672)

Writes binary data to a Stream object (SCRIPT)

wscript.exe (PID: 3672)

Uses RUNDLL32.EXE to load library

wscript.exe (PID: 3672)

Process requests binary or script from the Internet

wscript.exe (PID: 3672)

Searches for installed software

rundll32.exe (PID: 3304)

Reads settings of System Certificates

rundll32.exe (PID: 3304)

Loads DLL from Mozilla Firefox

rundll32.exe (PID: 3304)

The process verifies whether the antivirus software is installed

rundll32.exe (PID: 3304)

Executes as Windows Service

taskhost.exe (PID: 2064)

Reads browser cookies

rundll32.exe (PID: 3304)

Accesses Microsoft Outlook profiles

rundll32.exe (PID: 3304)

INFO

Checks proxy server information

wscript.exe (PID: 3672)
rundll32.exe (PID: 3304)

Reads Windows Product ID

rundll32.exe (PID: 3304)

Create files in a temporary directory

rundll32.exe (PID: 3304)

Threats

PID	Process	Class	Message
1080	svchost.exe	Potentially Bad Traffic	ET DNS Query to a *.top domain - Likely Hostile
3672	wscript.exe	Potentially Bad Traffic	ET INFO HTTP Request to a *.top domain
3672	wscript.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
3672	wscript.exe	A Network Trojan was detected	ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2
3672	wscript.exe	Misc activity	ET HUNTING Possible EXE Download From Suspicious TLD
3304	rundll32.exe	Malware Command and Control Activity Detected	STEALER [ANY.RUN] Danabot
3304	rundll32.exe	Malware Command and Control Activity Detected	STEALER [ANY.RUN] Danabot