| download: | /cloudflare.msi |
| Full analysis: | https://app.any.run/tasks/65e7c573-9a01-43ea-af01-e8156682615d |
| Verdict: | Malicious activity |
| Threats: | Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild, this is one of the most advanced thanks to the modular design and a complex delivery method. |
| Analysis date: | December 10, 2024, 17:11:12 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-msi |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: EasyDuplicateFinder, Author: Webminds, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install EasyDuplicateFinder., Template: Intel;1033, Revision Number: {0A54C263-3378-4839-8B1F-E728530DE644}, Create Time/Date: Wed Dec 4 16:16:08 2024, Last Saved Time/Date: Wed Dec 4 16:16:08 2024, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2 |
| MD5: | 5B4E1AE1818B630DAE4535EC96807462 |
| SHA1: | D1AD62A4B640FEF1835A4D4DD54BFB4D6DDAAFFC |
| SHA256: | CDFCFFCEFF42C4134D2E41F0BDE414ABE7A4B7E0480C8F4294EBCA0B4AB9AF24 |
| SSDEEP: | 98304:vwk4n2oZGLOFHgZne3J19ifXMDO9nyUyIOtHLKR3Q5Ex/tdKzDWNXT8doffmZsLe:jop5VNkYGxQGD5H9a+StbOy |
MALICIOUS
DANABOT has been detected (YARA)
- PDapp.exe (PID: 6224)
DANABOT has been detected (SURICATA)
- PDapp.exe (PID: 6224)
SUSPICIOUS
Reads the Windows owner or organization settings
- msiexec.exe (PID: 3732)
Process drops legitimate windows executable
- msiexec.exe (PID: 3732)
Searches for installed software
- PDapp.exe (PID: 6224)
Executes as Windows Service
- VSSVC.exe (PID: 6512)
The process drops C-runtime libraries
- msiexec.exe (PID: 3732)
Reads security settings of Internet Explorer
- PDapp.exe (PID: 6224)
Contacting a server suspected of hosting an CnC
- PDapp.exe (PID: 6224)
INFO
Reads the computer name
- msiexec.exe (PID: 3732)
- PDapp.exe (PID: 6224)
Manages system restore points
- SrTasks.exe (PID: 396)
Checks supported languages
- PDapp.exe (PID: 6224)
- msiexec.exe (PID: 3732)
The sample compiled with english language support
- msiexec.exe (PID: 3732)
Executable content was dropped or overwritten
- msiexec.exe (PID: 3732)
An automatically generated document
- msiexec.exe (PID: 7144)
Disables trace logs
- PDapp.exe (PID: 6224)
Creates a software uninstall entry
- msiexec.exe (PID: 3732)
Reads the machine GUID from the registry
- PDapp.exe (PID: 6224)
Reads CPU info
- PDapp.exe (PID: 6224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .msi | | | Microsoft Installer (100) |
|---|
EXIF
FlashPix
| CodePage: | Windows Latin 1 (Western European) |
|---|---|
| Title: | Installation Database |
| Subject: | EasyDuplicateFinder |
| Author: | Webminds, Inc. |
| Keywords: | Installer |
| Comments: | This installer database contains the logic and data required to install EasyDuplicateFinder. |
| Template: | Intel;1033 |
| RevisionNumber: | {0A54C263-3378-4839-8B1F-E728530DE644} |
| CreateDate: | 2024:12:04 16:16:08 |
| ModifyDate: | 2024:12:04 16:16:08 |
| Pages: | 200 |
| Words: | 10 |
| Software: | Windows Installer XML Toolset (3.14.1.8722) |
| Security: | Read-only recommended |
Total processes
128
Monitored processes
6
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 396 | C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11 | C:\Windows\System32\SrTasks.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Windows System Protection background tasks. Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3732 | C:\WINDOWS\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4556 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | SrTasks.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6224 | "C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe" | C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe | msiexec.exe | ||||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Application Manager Version: 10.0.0.49 Modules
| |||||||||||||||
| 6512 | C:\WINDOWS\system32\vssvc.exe | C:\Windows\System32\VSSVC.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7144 | "C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\cloudflare.msi | C:\Windows\System32\msiexec.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
8 653
Read events
7 629
Write events
1 006
Delete events
18
Modification events
| (PID) Process: | (3732) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore |
| Operation: | write | Name: | SrCreateRp (Enter) |
Value: 48000000000000006CB1968B264BDB01940E00001C190000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3732) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGetSnapshots (Enter) |
Value: 48000000000000006CB1968B264BDB01940E00001C190000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3732) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGetSnapshots (Leave) |
Value: 48000000000000003A88E08B264BDB01940E00001C190000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3732) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppEnumGroups (Enter) |
Value: 48000000000000003A88E08B264BDB01940E00001C190000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3732) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppEnumGroups (Leave) |
Value: 48000000000000002C50E58B264BDB01940E00001C190000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3732) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppCreate (Enter) |
Value: 48000000000000009FB5E78B264BDB01940E00001C190000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3732) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP |
| Operation: | write | Name: | LastIndex |
Value: 11 | |||
| (PID) Process: | (3732) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGatherWriterMetadata (Enter) |
Value: 48000000000000006B5B558C264BDB01940E00001C190000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3732) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4800000000000000ACBE578C264BDB01940E000054190000E8030000010000000000000000000000E2E4F81422B24E4E8715291A5709DF8F00000000000000000000000000000000 | |||
| (PID) Process: | (6512) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4800000000000000053B618C264BDB0170190000241B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
Executable files
24
Suspicious files
30
Text files
616
Unknown types
6
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3732 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
| 3732 | msiexec.exe | C:\Windows\Installer\13a183.msi | — | |
MD5:— | SHA256:— | |||
| 3732 | msiexec.exe | C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\console\License,3.txt | text | |
MD5:72937DBD9570EB6661403121A6413914 | SHA256:E3F31E8147A3C59DAF8AC8C528EEF60999C1DFA80B8A67695266CE631661FADD | |||
| 3732 | msiexec.exe | C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\btn\btn-default-large-over-fbg.gif | image | |
MD5:8DB65D5F17DB02BADAA465698320EC6B | SHA256:DB2F7E1E353429C5B38C584A4C4D9A76DE68EF1338335E3F852B38F2A6E17C10 | |||
| 3732 | msiexec.exe | C:\Windows\Installer\MSIA4DE.tmp | binary | |
MD5:8FA530F3A43E3D102127997B88F3F78A | SHA256:3D457656EABC683FB65330BE947A30F041C3EB96AA1D2FF55524FAA43916AB71 | |||
| 3732 | msiexec.exe | C:\Windows\Temp\~DF77BEB8E793171F8F.TMP | binary | |
MD5:6C4759387B8705AF0F84AF6A3915A817 | SHA256:0AF642866E20DF277282A65B40C65E35D5A800AC2683E33A89BDCFBF0F07F9DC | |||
| 3732 | msiexec.exe | C:\Windows\Temp\~DF194AB4C0327D72DD.TMP | gmc | |
MD5:BF619EAC0CDF3F68D496EA9344137E8B | SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 | |||
| 3732 | msiexec.exe | C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tab\tab-default-bottom-active-sides.gif | image | |
MD5:D1B7E6BF617777F7CD0941FC994E78C2 | SHA256:C71B980308D096221B86E37149388BCDE54E72F32049046748A15F60EFBC33AE | |||
| 3732 | msiexec.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{14f8e4e2-b222-4e4e-8715-291a5709df8f}_OnDiskSnapshotProp | binary | |
MD5:02AF9798DDA786335053B6EBEE7BDC3A | SHA256:4524F4B7F32BEF73F49C0745BBD0CD52C6DEF241A3B61BD3D197135BE3FE5262 | |||
| 3732 | msiexec.exe | C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\console\index.html | html | |
MD5:E2C8D0729892A4546BF82A581C3C62B1 | SHA256:111FE56F37FAD3AA651168C37203F66729F3366D62F3F2D069B037DE25F4AC62 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
27
DNS requests
10
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6636 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
5872 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5872 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2380 | RUXIMICS.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
1176 | svchost.exe | 40.126.31.71:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1176 | svchost.exe | 192.229.221.95:80 | — | EDGECAST | US | whitelisted |
— | — | 23.218.210.69:443 | go.microsoft.com | AKAMAI-AS | DE | whitelisted |
1076 | svchost.exe | 23.218.210.69:443 | go.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4328 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
6636 | backgroundTaskHost.exe | 20.199.58.43:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
6224 | PDapp.exe | Malware Command and Control Activity Detected | STEALER [ANY.RUN] Danabot TCP Packet |
6224 | PDapp.exe | Malware Command and Control Activity Detected | STEALER [ANY.RUN] Danabot TCP Packet |
6224 | PDapp.exe | Malware Command and Control Activity Detected | STEALER [ANY.RUN] Danabot TCP Packet |
6224 | PDapp.exe | Malware Command and Control Activity Detected | STEALER [ANY.RUN] Danabot TCP Packet |