Analysis

  • max time kernel
    127s
  • max time network
    120s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    08-07-2020 09:47

General

  • Target

    SecuriteInfo.com.Generic.mg.d1ad5859f4298afb.21100.exe

  • Size

    2.7MB

  • MD5

    d1ad5859f4298afb39f9747460c9f499

  • SHA1

    22b1e4142b34c3113772c31fe991c924c17ffaec

  • SHA256

    5137839a49af8a01ab62a213c963ad63c77dcfda6b107d46709aecebe3c4f415

  • SHA512

    be41fc0005263508df8020da14108bd46ab0938fa712e8222c43c5349f36d42296d97858eb610cb4af3cac24d056f16fc3a118d933f57dba979fc2735e2a45e2

Malware Config

Extracted

Family

danabot

C2

92.204.160.126

195.133.147.230

185.136.167.253

46.19.136.203

45.138.172.157

185.227.138.52

rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Danabot x86 payload 5 IoCs

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

  • Blocklisted process makes network request 10 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.d1ad5859f4298afb.21100.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.d1ad5859f4298afb.21100.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@384
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f0
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    695f7d7d9f4a4529ca53d8a5200b32f2

    SHA1

    b739d368c2e1742e3e83b6a269ac9cb70f767ad4

    SHA256

    1bbe068e16ef0a94849ccf991d55c61cde6fdd9c32ea6483183e0ee458a02236

    SHA512

    b94b896cc8b6256a15d25f616fd6a3b14bd8488589bdd07d1a8e7c9034521efc8ed27b9ed3880967485d34eb370bc5a2534a4e0696e36fd0d4d0700f7e207df6

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    695f7d7d9f4a4529ca53d8a5200b32f2

    SHA1

    b739d368c2e1742e3e83b6a269ac9cb70f767ad4

    SHA256

    1bbe068e16ef0a94849ccf991d55c61cde6fdd9c32ea6483183e0ee458a02236

    SHA512

    b94b896cc8b6256a15d25f616fd6a3b14bd8488589bdd07d1a8e7c9034521efc8ed27b9ed3880967485d34eb370bc5a2534a4e0696e36fd0d4d0700f7e207df6

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    695f7d7d9f4a4529ca53d8a5200b32f2

    SHA1

    b739d368c2e1742e3e83b6a269ac9cb70f767ad4

    SHA256

    1bbe068e16ef0a94849ccf991d55c61cde6fdd9c32ea6483183e0ee458a02236

    SHA512

    b94b896cc8b6256a15d25f616fd6a3b14bd8488589bdd07d1a8e7c9034521efc8ed27b9ed3880967485d34eb370bc5a2534a4e0696e36fd0d4d0700f7e207df6

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    695f7d7d9f4a4529ca53d8a5200b32f2

    SHA1

    b739d368c2e1742e3e83b6a269ac9cb70f767ad4

    SHA256

    1bbe068e16ef0a94849ccf991d55c61cde6fdd9c32ea6483183e0ee458a02236

    SHA512

    b94b896cc8b6256a15d25f616fd6a3b14bd8488589bdd07d1a8e7c9034521efc8ed27b9ed3880967485d34eb370bc5a2534a4e0696e36fd0d4d0700f7e207df6

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    695f7d7d9f4a4529ca53d8a5200b32f2

    SHA1

    b739d368c2e1742e3e83b6a269ac9cb70f767ad4

    SHA256

    1bbe068e16ef0a94849ccf991d55c61cde6fdd9c32ea6483183e0ee458a02236

    SHA512

    b94b896cc8b6256a15d25f616fd6a3b14bd8488589bdd07d1a8e7c9034521efc8ed27b9ed3880967485d34eb370bc5a2534a4e0696e36fd0d4d0700f7e207df6

  • memory/384-1-0x0000000003BA0000-0x0000000003BA1000-memory.dmp
    Filesize

    4KB

  • memory/3036-6-0x0000000000000000-mapping.dmp
  • memory/3052-2-0x0000000000000000-mapping.dmp