Analysis

  • max time kernel
    131s
  • max time network
    106s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    08-04-2021 21:54

General

  • Target

    SecuriteInfo.com.Ransom.Stop.P6.19307.25815.exe

  • Size

    5.8MB

  • MD5

    2fbdd54155f2cf4b6f41bf5e92d74696

  • SHA1

    3bafc4377abf9433acce914de93f18f29c66a3c8

  • SHA256

    4cf8cd89929828f99642b9992f5479dd7ef217ae9cdbddfd9a2b17300ddee655

  • SHA512

    a10a1e63ab67187caa6edd81e418a29fa56262ad3a196e0e54e341cebb38347242efe3265b79ed8eaf25ffbaf7a3d4aa72820c1e336593caf11ebcafe2a32915

Malware Config

Extracted

Family

danabot

Version

1827

Botnet

3

C2

23.106.123.249:443

23.106.123.141:443

23.254.225.170:443

134.119.186.216:443

Attributes
  • embedded_hash

    AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain
rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 4 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Ransom.Stop.P6.19307.25815.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Ransom.Stop.P6.19307.25815.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Windows\SysWOW64\RUNDLL32.EXE
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,hFspLDaHBQ==
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:3904

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\SECURI~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • memory/3904-122-0x0000000000000000-mapping.dmp
  • memory/3904-125-0x00000000045B0000-0x0000000004B6A000-memory.dmp
    Filesize

    5.7MB

  • memory/3904-129-0x0000000005660000-0x0000000005661000-memory.dmp
    Filesize

    4KB

  • memory/3904-128-0x0000000004EB1000-0x000000000550F000-memory.dmp
    Filesize

    6.4MB

  • memory/4224-117-0x0000000000000000-mapping.dmp
  • memory/4224-126-0x00000000050F1000-0x000000000574F000-memory.dmp
    Filesize

    6.4MB

  • memory/4224-127-0x0000000000E00000-0x0000000000EAE000-memory.dmp
    Filesize

    696KB

  • memory/4772-114-0x00000000054B0000-0x0000000005BA5000-memory.dmp
    Filesize

    7.0MB

  • memory/4772-116-0x0000000003150000-0x000000000329A000-memory.dmp
    Filesize

    1.3MB

  • memory/4772-115-0x0000000000400000-0x000000000314A000-memory.dmp
    Filesize

    45.3MB