Edit tour

Windows Analysis Report
gfehgfwveg.exe

Overview

General Information

Sample name:	gfehgfwveg.exe
Analysis ID:	1580519
MD5:	43ec2649e1b173b6e8b3800e18cceeb4
SHA1:	e864b2d11a7c9c7497b22af930b31db1e2061244
SHA256:	4e906e880e35e4bc0de7e9375fc0feb5757374ca0bb628dff6366174536d6183
Tags:	exeuser-SquiblydooBlog
Infos:

Detection

DanaBot

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DanaBot stealer dll

AI detected suspicious sample

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

May use the Tor software to hide its network traffic

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Abnormal high CPU Usage

Creates a process in suspended mode (likely to inject code)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential time zone aware malware

Program does not show much activity (idle)

Queries information about the installed CPU (vendor, model number etc)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

gfehgfwveg.exe (PID: 6464 cmdline: "C:\Users\user\Desktop\gfehgfwveg.exe" MD5: 43EC2649E1B173B6E8B3800E18CCEEB4)

cmd.exe (PID: 940 cmdline: cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1532 cmdline: wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DanaBot	Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on quality over quantity in email-based threats. DanaBots modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.	SCULLY SPIDER	https://asec.ahnlab.com/en/30445/ https://asert.arbornetworks.com/danabots-travels-a-global-perspective/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.lexfo.fr/danabot-malware.html https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: gfehgfwveg.exe PID: 6464	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gfehgfwveg.exe PID: 6464	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET MALWARE Danabot Key Exchange Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T20:49:57.437474+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49800	34.34.145.103	443	TCP
2024-12-24T20:49:58.536827+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49803	34.169.99.17	443	TCP
2024-12-24T20:49:59.665387+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49804	34.83.67.185	443	TCP
2024-12-24T20:50:00.749409+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49810	35.195.45.98	443	TCP
2024-12-24T20:50:08.252668+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49830	34.34.145.103	443	TCP
2024-12-24T20:50:09.525522+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49834	34.169.99.17	443	TCP
2024-12-24T20:50:10.603924+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49837	34.83.67.185	443	TCP
2024-12-24T20:50:11.730286+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49841	35.195.45.98	443	TCP
2024-12-24T20:50:17.308243+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49858	34.34.145.103	443	TCP
2024-12-24T20:50:17.396534+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49859	34.169.99.17	443	TCP
2024-12-24T20:50:17.477840+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49860	34.83.67.185	443	TCP
2024-12-24T20:50:17.587969+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49861	35.195.45.98	443	TCP
2024-12-24T20:50:26.896409+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49886	34.34.145.103	443	TCP
2024-12-24T20:50:28.769519+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49890	34.169.99.17	443	TCP
2024-12-24T20:50:30.353915+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49896	34.83.67.185	443	TCP
2024-12-24T20:50:32.149921+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49899	35.195.45.98	443	TCP
2024-12-24T20:50:35.421217+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49912	34.34.145.103	443	TCP
2024-12-24T20:50:37.234985+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49918	34.169.99.17	443	TCP
2024-12-24T20:50:38.845690+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49921	34.83.67.185	443	TCP
2024-12-24T20:50:40.365380+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49927	35.195.45.98	443	TCP
2024-12-24T20:50:49.840728+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49952	34.34.145.103	443	TCP
2024-12-24T20:50:49.950089+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49955	34.169.99.17	443	TCP
2024-12-24T20:50:50.101927+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49956	34.83.67.185	443	TCP
2024-12-24T20:50:50.286070+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49957	35.195.45.98	443	TCP
2024-12-24T20:51:01.351951+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49983	34.34.145.103	443	TCP
2024-12-24T20:51:03.495105+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49988	34.169.99.17	443	TCP
2024-12-24T20:51:04.974891+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49991	34.83.67.185	443	TCP
2024-12-24T20:51:07.388822+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49998	35.195.45.98	443	TCP
2024-12-24T20:51:10.773407+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50011	34.34.145.103	443	TCP
2024-12-24T20:51:13.480850+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50018	34.169.99.17	443	TCP
2024-12-24T20:51:16.231070+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50023	34.83.67.185	443	TCP
2024-12-24T20:51:17.843648+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50028	35.195.45.98	443	TCP
2024-12-24T20:51:30.006700+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50044	34.34.145.103	443	TCP
2024-12-24T20:51:30.084499+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50045	34.169.99.17	443	TCP
2024-12-24T20:51:30.147283+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50046	34.83.67.185	443	TCP
2024-12-24T20:51:30.274087+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50047	35.195.45.98	443	TCP
2024-12-24T20:51:42.384115+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50052	34.34.145.103	443	TCP
2024-12-24T20:51:45.127272+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50053	34.169.99.17	443	TCP
2024-12-24T20:51:47.363251+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50054	34.83.67.185	443	TCP
2024-12-24T20:51:49.543295+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50055	35.195.45.98	443	TCP
2024-12-24T20:51:53.492437+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50060	34.34.145.103	443	TCP
2024-12-24T20:51:56.140020+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50061	34.169.99.17	443	TCP
2024-12-24T20:51:58.720024+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50062	34.83.67.185	443	TCP
2024-12-24T20:52:00.858456+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50063	35.195.45.98	443	TCP
2024-12-24T20:52:14.200139+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50068	34.34.145.103	443	TCP
2024-12-24T20:52:14.310341+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50069	34.169.99.17	443	TCP
2024-12-24T20:52:14.394340+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50070	34.83.67.185	443	TCP
2024-12-24T20:52:14.471379+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50071	35.195.45.98	443	TCP
2024-12-24T20:52:26.921628+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50076	34.34.145.103	443	TCP
2024-12-24T20:52:29.172493+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50077	34.169.99.17	443	TCP
2024-12-24T20:52:31.469787+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50078	34.83.67.185	443	TCP
2024-12-24T20:52:33.819170+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50079	35.195.45.98	443	TCP
2024-12-24T20:52:39.115081+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50084	34.34.145.103	443	TCP
2024-12-24T20:52:41.407909+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50085	34.169.99.17	443	TCP
2024-12-24T20:52:43.802047+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50086	34.83.67.185	443	TCP
2024-12-24T20:52:45.270054+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50087	35.195.45.98	443	TCP
2024-12-24T20:52:50.668751+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50092	34.34.145.103	443	TCP
2024-12-24T20:52:50.725016+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50093	34.169.99.17	443	TCP
2024-12-24T20:52:50.800171+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50094	34.83.67.185	443	TCP
2024-12-24T20:52:50.851757+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50095	35.195.45.98	443	TCP
2024-12-24T20:52:58.374899+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50100	34.34.145.103	443	TCP
2024-12-24T20:52:59.434077+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50101	34.169.99.17	443	TCP
2024-12-24T20:53:00.520563+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50102	34.83.67.185	443	TCP
2024-12-24T20:53:01.628273+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50103	35.195.45.98	443	TCP
2024-12-24T20:53:03.916416+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50108	34.34.145.103	443	TCP
2024-12-24T20:53:04.997393+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50109	34.169.99.17	443	TCP
2024-12-24T20:53:06.099941+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50110	34.83.67.185	443	TCP
2024-12-24T20:53:07.154378+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50111	35.195.45.98	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: gfehgfwveg.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: gfehgfwveg.exe

ReversingLabs: Detection: 55%

Yara detected DanaBot stealer dll

Source: Yara match	File source: 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 6464, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.9% probability

Machine Learning detection for sample

Source: gfehgfwveg.exe

Joe Sandbox ML: detected

Source: gfehgfwveg.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49800 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49803 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49804 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49834 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49810 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49830 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49841 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49859 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49861 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49837 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49858 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49886 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49890 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49896 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49860 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49899 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49912 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49918 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49921 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49927 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49955 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49952 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49957 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49956 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49983 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49988 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49991 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49998 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50011 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50018 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50023 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50028 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50044 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50045 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50046 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50047 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50053 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50052 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50054 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50055 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50060 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50062 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50063 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50061 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50069 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50070 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50071 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50076 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50077 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50068 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50079 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50086 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50078 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50085 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50084 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50087 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50092 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50093 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50095 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50100 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50101 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50102 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50103 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50094 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50109 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50110 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50111 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50108 -> 34.34.145.103:443

Source: Joe Sandbox View	ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS
Source: Joe Sandbox View	ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS

Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103

Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: gfehgfwveg.exe, 00000000.00000003.2097989940.000000007EB44000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2099321079.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: gfehgfwveg.exe, 00000000.00000003.2097140713.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: gfehgfwveg.exe, 00000000.00000003.2097140713.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443

E-Banking Fraud

Yara detected DanaBot stealer dll

Source: Yara match	File source: 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 6464, type: MEMORYSTR

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Process Stats: CPU usage > 49%

Source: gfehgfwveg.exe

Static PE information: Number of sections : 11 > 10

Source: gfehgfwveg.exe, 00000000.00000003.2097989940.000000007EB44000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs gfehgfwveg.exe
Source: gfehgfwveg.exe, 00000000.00000003.2099321079.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs gfehgfwveg.exe

Source: gfehgfwveg.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal92.troj.evad.winEXE@6/0@0/4

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5512:120:WilError_03

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: gfehgfwveg.exe, 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: gfehgfwveg.exe

ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\gfehgfwveg.exe "C:\Users\user\Desktop\gfehgfwveg.exe"
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: gfehgfwveg.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: gfehgfwveg.exe

Static file information: File size 4276224 > 1048576

Source: gfehgfwveg.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3ec600

Source: gfehgfwveg.exe

Static PE information: section name: .didata

Hooking and other Techniques for Hiding and Protection

May use the Tor software to hide its network traffic

Source: gfehgfwveg.exe, 00000000.00000003.2093905422.000000007E870000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: torConnect

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE DeviceID=\'c:\'
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE DeviceID=\'c:\'

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Window / User API: threadDelayed 9960

Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: gfehgfwveg.exe, 00000000.00000003.2100996287.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}l
Source: gfehgfwveg.exe, 00000000.00000003.2100996287.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\Y

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Process Stats: CPU usage > 42% for more than 60s

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value			Jump to behavior

Source: gfehgfwveg.exe, 00000000.00000003.2093905422.000000007E870000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32U
Source: gfehgfwveg.exe, 00000000.00000003.2093905422.000000007E870000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DanaBot stealer dll

Source: Yara match	File source: 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 6464, type: MEMORYSTR

Source: Yara match

File source: Process Memory Space: gfehgfwveg.exe PID: 6464, type: MEMORYSTR

Remote Access Functionality

Yara detected DanaBot stealer dll

Source: Yara match	File source: 00000000.00000003.2094443248.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 6464, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Multi-hop Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	142 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
gfehgfwveg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gfehgfwveg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
gfehgfwveg.exe