Analysis

  • max time kernel
    134s
  • max time network
    62s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    08-04-2021 17:23

General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware2.22585.8898.exe

  • Size

    5MB

  • MD5

    9b42eb3cdc45c92627443ad515f78d55

  • SHA1

    d9aba4852576efbd967afe7e5e72a2cd371b4eda

  • SHA256

    a428c991e0a345db62de9fb32dbfd3e2755c9460a785ff69fbc1639cd5d2b020

  • SHA512

    f23998c8cfe851b719be3cf2e22dbfdb88b4e02abccdd760fa10576c2f216bedd750f502c05a646cf3152fad5dc6fac2d22267b0dbca3fbb694bfe2f9226ec55

Malware Config

Extracted

Family

danabot

Version

1827

Botnet

3

C2

23.106.123.249:443

23.106.123.141:443

23.254.225.170:443

134.119.186.216:443

Attributes
  • embedded_hash

    AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain
rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 4 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.22585.8898.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.22585.8898.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Windows\SysWOW64\RUNDLL32.EXE
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,dk4oTJ8=
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:1688

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • memory/1412-79-0x0000000000130000-0x0000000000131000-memory.dmp
    Filesize

    4KB

  • memory/1412-70-0x0000000002030000-0x00000000025EA000-memory.dmp
    Filesize

    5MB

  • memory/1412-71-0x00000000028C1000-0x0000000002F1F000-memory.dmp
    Filesize

    6MB

  • memory/1412-72-0x0000000003170000-0x0000000003171000-memory.dmp
    Filesize

    4KB

  • memory/1412-63-0x0000000000000000-mapping.dmp
  • memory/1688-73-0x0000000000000000-mapping.dmp
  • memory/1688-80-0x00000000020A0000-0x000000000265A000-memory.dmp
    Filesize

    5MB

  • memory/1688-81-0x0000000002660000-0x0000000002661000-memory.dmp
    Filesize

    4KB

  • memory/1688-82-0x0000000002B41000-0x000000000319F000-memory.dmp
    Filesize

    6MB

  • memory/1808-61-0x0000000000400000-0x0000000003149000-memory.dmp
    Filesize

    45MB

  • memory/1808-59-0x0000000076341000-0x0000000076343000-memory.dmp
    Filesize

    8KB

  • memory/1808-62-0x0000000000220000-0x0000000000221000-memory.dmp
    Filesize

    4KB

  • memory/1808-60-0x0000000005240000-0x0000000005935000-memory.dmp
    Filesize

    6MB