Overview

overview

10

Static

static

56ec14575d...4e.exe

windows7_x64

10

56ec14575d...4e.exe

windows10_x64

10

Analysis

  • max time kernel
    134s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09/11/2020, 20:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    56ec14575dd92a3344e67cbe8e80ef4e.exe
  • Size 2.6MB
  • Sample201109-ty23fcnfee
  • SHA256 02ef6ffbe2b06f3b6c2b6e3d3054bc80c5996f550cd8ecd9928cbb3e13928a16
  • MD5 SHA1 SHA512
Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

  • danabot

C2

  • 93.115.21.232

  • 109.200.24.21

  • 93.115.21.236

rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Danabot x86 payload 4 IoCs

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56ec14575dd92a3344e67cbe8e80ef4e.exe
    "C:\Users\Admin\AppData\Local\Temp\56ec14575dd92a3344e67cbe8e80ef4e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4780
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\56EC14~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\56EC14~1.EXE@4780
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\56EC14~1.DLL,f0
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 428
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:560

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/560-3-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
        Download

        memory/560-4-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
        Download

        memory/560-8-0x00000000050D0000-0x00000000050D1000-memory.dmp
        Download

        memory/4780-1-0x0000000003530000-0x0000000003531000-memory.dmp
        Download