Resubmissions

22-01-2021 13:50

210122-8mzgcvqz7j 8

22-01-2021 13:30

210122-9kfvyp6lrx 8

22-01-2021 13:27

210122-t61ddv7plj 10

Analysis

  • max time kernel
    129s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22-01-2021 13:27

General

  • Target

    06456edb20ab947356811ad8ce3a16ae3ea702342163b67907217a3d28b6d698.dll

Malware Config

Extracted

Family

danabot

Version

1755

Botnet

21

C2

47.254.174.158:1024

159.89.114.62:443

47.254.247.133:443

138.197.139.56:443

Attributes
  • embedded_hash

    9C7D6A0C33FE7EDD9922FFD6D97552CA

rsa_pubkey.plain
rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\06456edb20ab947356811ad8ce3a16ae3ea702342163b67907217a3d28b6d698.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:728
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\06456edb20ab947356811ad8ce3a16ae3ea702342163b67907217a3d28b6d698.dll
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:984
      • C:\Windows\SysWOW64\RUNDLL32.EXE
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\06456edb20ab947356811ad8ce3a16ae3ea702342163b67907217a3d28b6d698.dll,JgsbLDbfBpzf
        3⤵
        • Blocklisted process makes network request
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2732
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp7063.tmp.ps1"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3680
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp93EB.tmp.ps1"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:740
          • C:\Windows\SysWOW64\nslookup.exe
            "C:\Windows\system32\nslookup.exe" -type=any localhost
            5⤵
              PID:3912
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
            4⤵
              PID:1904
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
              4⤵
                PID:988

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        Collection

        Data from Local System

        1
        T1005

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          MD5

          47eebe401625bbc55e75dbfb72e9e89a

          SHA1

          db3b2135942d2532c59b9788253638eb77e5995e

          SHA256

          f1cd56000c44bbdb6880b5b133731f493fe8cba8198c5a861da6ae7b489ed0c3

          SHA512

          590b149863d58be346e7927c28501375cc570858d2f156d234b03d68b86c5c0667a1038e2b6f6639172bf95638ca9f7c70f45270951abbcdf43b1be853b81d56

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          MD5

          fd8c9cf0dce1372f1f33033ebb16bfe8

          SHA1

          119fd321a81a6ec797a4bf4dfa4329d98d9ae261

          SHA256

          bc69ff3eec82d6dbe8664b5c6ef55dbaaeb4d9818c49eaf4bd7a0b9f15134658

          SHA512

          037212a207d12491aee6316b15355d9fb3730d0d6ba8db279522188a131d7f4a1cc219be59940136500fa20ee7f7de59ce79c8d2c5a4f91de7fa1dd7bc7dc459

        • C:\Users\Admin\AppData\Local\Temp\tmp7063.tmp.ps1
          MD5

          5cc04bd7624d6c430fa643b0c54b4b38

          SHA1

          19a87a03b97b2639553898418be1aaa0bc2e9b04

          SHA256

          eacf90fa865fbe6a3119e59cdfe483b4a6bff94b36a9d5df0a2fb12c0f06a59f

          SHA512

          43438baa76b4abed06007beeea05a74bcdab7d1889265da51222c3e977255bb3f2eb0553cf0cb0e5096daeb6a35b25e792d234fa04a47c7e1720a7967bf77efb

        • C:\Users\Admin\AppData\Local\Temp\tmp7064.tmp
          MD5

          c416c12d1b2b1da8c8655e393b544362

          SHA1

          fb1a43cd8e1c556c2d25f361f42a21293c29e447

          SHA256

          0600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046

          SHA512

          cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c

        • C:\Users\Admin\AppData\Local\Temp\tmp93EB.tmp.ps1
          MD5

          8c4e7e7630355ddc2474ae6c401c8245

          SHA1

          b9f57e29edd422984d1726a365be716c1f09da3d

          SHA256

          0f4ff84568439f72606f3b36c7a27319014c45f3ac909684f81ebd3787472b9f

          SHA512

          89d17e80d6b717af793ddff708de508cd55c135aaed04e719d1db7a68cd61ec91ab68fd160a058498418201b352f1ed176d43d8012fe88527a79638e568b0e29

        • C:\Users\Admin\AppData\Local\Temp\tmp93EC.tmp
          MD5

          1860260b2697808b80802352fe324782

          SHA1

          f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b

          SHA256

          0c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1

          SHA512

          d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f

        • memory/740-35-0x0000000001220000-0x0000000001221000-memory.dmp
          Filesize

          4KB

        • memory/740-43-0x00000000084B0000-0x00000000084B1000-memory.dmp
          Filesize

          4KB

        • memory/740-30-0x0000000000000000-mapping.dmp
        • memory/740-32-0x00000000702B0000-0x000000007099E000-memory.dmp
          Filesize

          6.9MB

        • memory/740-50-0x0000000001223000-0x0000000001224000-memory.dmp
          Filesize

          4KB

        • memory/740-36-0x0000000001222000-0x0000000001223000-memory.dmp
          Filesize

          4KB

        • memory/740-40-0x0000000007A40000-0x0000000007A41000-memory.dmp
          Filesize

          4KB

        • memory/984-4-0x0000000004E80000-0x0000000005602000-memory.dmp
          Filesize

          7.5MB

        • memory/984-3-0x0000000003380000-0x0000000003381000-memory.dmp
          Filesize

          4KB

        • memory/984-2-0x0000000000000000-mapping.dmp
        • memory/984-6-0x0000000006571000-0x0000000006BCE000-memory.dmp
          Filesize

          6.4MB

        • memory/988-52-0x0000000000000000-mapping.dmp
        • memory/1904-51-0x0000000000000000-mapping.dmp
        • memory/2732-8-0x0000000000400000-0x0000000000B82000-memory.dmp
          Filesize

          7.5MB

        • memory/2732-5-0x0000000000000000-mapping.dmp
        • memory/2732-9-0x0000000005B41000-0x000000000619E000-memory.dmp
          Filesize

          6.4MB

        • memory/3680-18-0x0000000007C80000-0x0000000007C81000-memory.dmp
          Filesize

          4KB

        • memory/3680-19-0x0000000007CF0000-0x0000000007CF1000-memory.dmp
          Filesize

          4KB

        • memory/3680-27-0x00000000085F0000-0x00000000085F1000-memory.dmp
          Filesize

          4KB

        • memory/3680-25-0x0000000009C70000-0x0000000009C71000-memory.dmp
          Filesize

          4KB

        • memory/3680-29-0x0000000004A23000-0x0000000004A24000-memory.dmp
          Filesize

          4KB

        • memory/3680-24-0x0000000007020000-0x0000000007021000-memory.dmp
          Filesize

          4KB

        • memory/3680-22-0x0000000008470000-0x0000000008471000-memory.dmp
          Filesize

          4KB

        • memory/3680-21-0x0000000008730000-0x0000000008731000-memory.dmp
          Filesize

          4KB

        • memory/3680-20-0x0000000008180000-0x0000000008181000-memory.dmp
          Filesize

          4KB

        • memory/3680-26-0x0000000009200000-0x0000000009201000-memory.dmp
          Filesize

          4KB

        • memory/3680-10-0x0000000000000000-mapping.dmp
        • memory/3680-17-0x0000000007B10000-0x0000000007B11000-memory.dmp
          Filesize

          4KB

        • memory/3680-16-0x00000000073F0000-0x00000000073F1000-memory.dmp
          Filesize

          4KB

        • memory/3680-14-0x0000000004A20000-0x0000000004A21000-memory.dmp
          Filesize

          4KB

        • memory/3680-11-0x0000000070910000-0x0000000070FFE000-memory.dmp
          Filesize

          6.9MB

        • memory/3680-15-0x0000000004A22000-0x0000000004A23000-memory.dmp
          Filesize

          4KB

        • memory/3680-13-0x0000000007470000-0x0000000007471000-memory.dmp
          Filesize

          4KB

        • memory/3680-12-0x0000000004990000-0x0000000004991000-memory.dmp
          Filesize

          4KB

        • memory/3912-48-0x0000000000000000-mapping.dmp