Analysis

  • max time kernel
    133s
  • max time network
    123s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09-04-2021 20:05

General

  • Target

    9a7db2d65e31976cd21e523c7057dff3.exe

  • Size

    5.8MB

  • MD5

    9a7db2d65e31976cd21e523c7057dff3

  • SHA1

    87592aed0ef32252b679bf1acd980bac28238fb6

  • SHA256

    96bffd270b414da3f4efdc93714b11ea02f8b882f4a1368d58d976541a4f5f56

  • SHA512

    8b89116319be53c7c531710b6aa36a7f80e6034a8d9642585a79c2e5182393bfb6350ad3be57ab0f9600fb51d79cd6e9f63c53e3719b8cfcde7e659f5d0cd3bc

Malware Config

Extracted

Family

danabot

Version

1827

Botnet

3

C2

23.106.123.249:443

23.106.123.141:443

23.254.225.170:443

134.119.186.216:443

Attributes
  • embedded_hash

    AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain
rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 4 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a7db2d65e31976cd21e523c7057dff3.exe
    "C:\Users\Admin\AppData\Local\Temp\9a7db2d65e31976cd21e523c7057dff3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\9A7DB2~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\9A7DB2~1.EXE
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4164
      • C:\Windows\SysWOW64\RUNDLL32.EXE
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\9A7DB2~1.DLL,kE5CLDakBTw=
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:3116

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9A7DB2~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\9A7DB2~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\9A7DB2~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • \Users\Admin\AppData\Local\Temp\9A7DB2~1.DLL
    MD5

    d4010f789559c6c981ab6d80854e9576

    SHA1

    598209c8242bba79d090feb16a80c1326a5617aa

    SHA256

    10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784

    SHA512

    438f238feed48a3bab69ca918ed249e6b7e18e558855fa53283f81097754f350e6f448008d3d1a7d1710319b44fba6a2bbf6019664d09a7bc97ba915d559f0e5

  • memory/3116-123-0x0000000000000000-mapping.dmp
  • memory/3116-129-0x0000000004F21000-0x000000000557F000-memory.dmp
    Filesize

    6.4MB

  • memory/4164-117-0x0000000000000000-mapping.dmp
  • memory/4164-121-0x0000000004620000-0x0000000004BDA000-memory.dmp
    Filesize

    5.7MB

  • memory/4164-122-0x0000000005A90000-0x0000000005A91000-memory.dmp
    Filesize

    4KB

  • memory/4164-125-0x0000000005201000-0x000000000585F000-memory.dmp
    Filesize

    6.4MB

  • memory/4164-128-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
    Filesize

    4KB

  • memory/4688-115-0x0000000000400000-0x0000000003149000-memory.dmp
    Filesize

    45.3MB

  • memory/4688-114-0x00000000057A0000-0x0000000005E95000-memory.dmp
    Filesize

    7.0MB

  • memory/4688-116-0x0000000003150000-0x00000000031FE000-memory.dmp
    Filesize

    696KB