Analysis

  • max time kernel
    133s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    08-04-2021 23:40

General

  • Target

    SecuriteInfo.com.Trojan.GenericKDZ.74048.21519.23029.exe

  • Size

    5.9MB

  • MD5

    3f77134ae0706201d0c6407c7b4ef2da

  • SHA1

    0a9eb6ffd2bc52aa3cab9700418672e209e74011

  • SHA256

    b53c82188e5e8c89291ed3c6ff22722a228075fd77165664a35559cdd224ea63

  • SHA512

    c26c7394adfdc74677a0dd6248bea006d18221d59c698dc66c6bf1be4c60fe55ad011ca613c53b3de1350891f8b38aa2d7271fca05b36b9faf2cc48b00689fca

Malware Config

Extracted

Family

danabot

Version

1827

Botnet

3

C2

23.106.123.249:443

23.106.123.141:443

23.254.225.170:443

134.119.186.216:443

Attributes
  • embedded_hash

    AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain
rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.74048.21519.23029.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.74048.21519.23029.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3564
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3260
      • C:\Windows\SysWOW64\RUNDLL32.EXE
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,TCErLDamBdz4
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp8CD4.tmp.ps1"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1160
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpA0BC.tmp.ps1"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2964
          • C:\Windows\SysWOW64\nslookup.exe
            "C:\Windows\system32\nslookup.exe" -type=any localhost
            5⤵
              PID:3484
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
            4⤵
              PID:2840
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
              4⤵
                PID:2320

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        Collection

        Data from Local System

        1
        T1005

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          MD5

          47eebe401625bbc55e75dbfb72e9e89a

          SHA1

          db3b2135942d2532c59b9788253638eb77e5995e

          SHA256

          f1cd56000c44bbdb6880b5b133731f493fe8cba8198c5a861da6ae7b489ed0c3

          SHA512

          590b149863d58be346e7927c28501375cc570858d2f156d234b03d68b86c5c0667a1038e2b6f6639172bf95638ca9f7c70f45270951abbcdf43b1be853b81d56

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          MD5

          270fdac55fe24ec07ee20b48f221fa40

          SHA1

          8e96b5f06bcc96090672e15cbea0756c9dcb3a37

          SHA256

          7330b69ffc1fe5731ed6def3b86d5eb2cb0b35cf3b2e45c827620402f64e260a

          SHA512

          720f34652136da0d6a60886e91e231952332a1ba55a1284329e0ad5bf6add45c4119424589b2757d0a1c9a5f9a08fbcc06053ac6bd6b3d1536aeb63e9bd74059

        • C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
          MD5

          d4010f789559c6c981ab6d80854e9576

          SHA1

          598209c8242bba79d090feb16a80c1326a5617aa

          SHA256

          10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

          SHA512

          438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

        • C:\Users\Admin\AppData\Local\Temp\tmp8CD4.tmp.ps1
          MD5

          c3711fd0325d6ebf0bb8f7569489e9bb

          SHA1

          7bcd1e9fae913509b21160aaebc881c5bc61c445

          SHA256

          ca39094efcece76481dfa76d8545a40a4eb066bf9ea695da2e08ea564dc3e9b9

          SHA512

          d37c5a3756d512e675571e926ac8d83be17e414b2032b6e1a7a7cb1ed3064e511870629c95eb8f52f872b3c8e841672afd5c58ec12bf7a9ffc3ccb7c470e6664

        • C:\Users\Admin\AppData\Local\Temp\tmp8CD5.tmp
          MD5

          c416c12d1b2b1da8c8655e393b544362

          SHA1

          fb1a43cd8e1c556c2d25f361f42a21293c29e447

          SHA256

          0600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046

          SHA512

          cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c

        • C:\Users\Admin\AppData\Local\Temp\tmpA0BC.tmp.ps1
          MD5

          0ac090bc9454c3f72f73c3cff8687287

          SHA1

          d0000752f80fb13881a6b87df83b922d34634c92

          SHA256

          5d63466ddc600cf5d22d35190e9c654b661a3989082cd7f891c3d417f43b2b1f

          SHA512

          309f6f69dbeb4dc3a60cc9db2255f5ca703c42ba255c73170feba1429636e603ebba591975c9e43206db74423bbe510f201f86330c0a5d3ff9328d6cb9d0ba31

        • C:\Users\Admin\AppData\Local\Temp\tmpA0BD.tmp
          MD5

          1860260b2697808b80802352fe324782

          SHA1

          f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b

          SHA256

          0c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1

          SHA512

          d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f

        • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
          MD5

          d4010f789559c6c981ab6d80854e9576

          SHA1

          598209c8242bba79d090feb16a80c1326a5617aa

          SHA256

          10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

          SHA512

          438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

        • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
          MD5

          d4010f789559c6c981ab6d80854e9576

          SHA1

          598209c8242bba79d090feb16a80c1326a5617aa

          SHA256

          10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

          SHA512

          438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

        • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
          MD5

          d4010f789559c6c981ab6d80854e9576

          SHA1

          598209c8242bba79d090feb16a80c1326a5617aa

          SHA256

          10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

          SHA512

          438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

        • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
          MD5

          d4010f789559c6c981ab6d80854e9576

          SHA1

          598209c8242bba79d090feb16a80c1326a5617aa

          SHA256

          10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

          SHA512

          438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

        • memory/1160-166-0x0000000004723000-0x0000000004724000-memory.dmp
          Filesize

          4KB

        • memory/1160-146-0x0000000008340000-0x0000000008341000-memory.dmp
          Filesize

          4KB

        • memory/1160-153-0x0000000009220000-0x0000000009221000-memory.dmp
          Filesize

          4KB

        • memory/1160-152-0x0000000008F50000-0x0000000008F51000-memory.dmp
          Filesize

          4KB

        • memory/1160-151-0x00000000099C0000-0x00000000099C1000-memory.dmp
          Filesize

          4KB

        • memory/1160-144-0x00000000082C0000-0x00000000082C1000-memory.dmp
          Filesize

          4KB

        • memory/1160-131-0x0000000000000000-mapping.dmp
        • memory/1160-134-0x00000000046D0000-0x00000000046D1000-memory.dmp
          Filesize

          4KB

        • memory/1160-135-0x00000000071A0000-0x00000000071A1000-memory.dmp
          Filesize

          4KB

        • memory/1160-136-0x0000000007140000-0x0000000007141000-memory.dmp
          Filesize

          4KB

        • memory/1160-137-0x0000000007840000-0x0000000007841000-memory.dmp
          Filesize

          4KB

        • memory/1160-138-0x0000000007A90000-0x0000000007A91000-memory.dmp
          Filesize

          4KB

        • memory/1160-139-0x0000000007B30000-0x0000000007B31000-memory.dmp
          Filesize

          4KB

        • memory/1160-140-0x0000000004720000-0x0000000004721000-memory.dmp
          Filesize

          4KB

        • memory/1160-141-0x0000000004722000-0x0000000004723000-memory.dmp
          Filesize

          4KB

        • memory/1160-142-0x0000000007900000-0x0000000007901000-memory.dmp
          Filesize

          4KB

        • memory/1160-143-0x0000000008270000-0x0000000008271000-memory.dmp
          Filesize

          4KB

        • memory/2280-167-0x0000000000A50000-0x0000000000A51000-memory.dmp
          Filesize

          4KB

        • memory/2280-123-0x0000000000000000-mapping.dmp
        • memory/2280-126-0x0000000004070000-0x000000000462A000-memory.dmp
          Filesize

          5.7MB

        • memory/2280-129-0x00000000052D0000-0x00000000052D1000-memory.dmp
          Filesize

          4KB

        • memory/2280-130-0x0000000004A61000-0x00000000050BF000-memory.dmp
          Filesize

          6.4MB

        • memory/2320-186-0x0000000000000000-mapping.dmp
        • memory/2840-184-0x0000000000000000-mapping.dmp
        • memory/2964-172-0x00000000089B0000-0x00000000089B1000-memory.dmp
          Filesize

          4KB

        • memory/2964-169-0x0000000007162000-0x0000000007163000-memory.dmp
          Filesize

          4KB

        • memory/2964-185-0x0000000007163000-0x0000000007164000-memory.dmp
          Filesize

          4KB

        • memory/2964-165-0x0000000007F70000-0x0000000007F71000-memory.dmp
          Filesize

          4KB

        • memory/2964-156-0x0000000000000000-mapping.dmp
        • memory/2964-168-0x0000000007160000-0x0000000007161000-memory.dmp
          Filesize

          4KB

        • memory/3260-117-0x0000000000000000-mapping.dmp
        • memory/3260-121-0x0000000004630000-0x0000000004BEA000-memory.dmp
          Filesize

          5.7MB

        • memory/3260-122-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
          Filesize

          4KB

        • memory/3260-128-0x0000000000AA0000-0x0000000000B4E000-memory.dmp
          Filesize

          696KB

        • memory/3260-127-0x0000000005221000-0x000000000587F000-memory.dmp
          Filesize

          6.4MB

        • memory/3484-181-0x0000000000000000-mapping.dmp
        • memory/3564-116-0x00000000033B0000-0x00000000033B1000-memory.dmp
          Filesize

          4KB

        • memory/3564-115-0x0000000000400000-0x000000000314A000-memory.dmp
          Filesize

          45.3MB

        • memory/3564-114-0x0000000005500000-0x0000000005BF5000-memory.dmp
          Filesize

          7.0MB