danabot | 5b734bc6167cacb768f5fd8d539042b3b67f8ef91dacf9214d1b7288ab2f8f32

Analysis

max time kernel
131s
max time network
115s
platform
windows10_x64
resource
win10v20201028
submitted
11-04-2021 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

529d344142103e0620243e92caa08d5a.exe
Size

5.8MB
MD5

529d344142103e0620243e92caa08d5a
SHA1

bd1b2f1143953377c1246aa002db68963e7fa50a
SHA256

5b734bc6167cacb768f5fd8d539042b3b67f8ef91dacf9214d1b7288ab2f8f32
SHA512

59883b15a5ea76a0aaeaa63d877559cf24832d1c0bb34b3d230ed216c4a442a2b81aab80cd90d13a176157acc64f64b6df3edeff97a12dfc9117876266210d34

Score

10^/10

danabot 3 banker discovery spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1827

Botnet

23.81.246.201:443

23.254.225.170:443

134.119.186.216:443

23.106.123.185:443

Attributes

embedded_hash
AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 1 IoCs

Processes:

RUNDLL32.EXE

flow pid process

11 732 RUNDLL32.EXE
Deletes itself 1 IoCs

Processes:

rundll32.exe

pid process

2316 rundll32.exe
Loads dropped DLL 3 IoCs

Processes:

rundll32.exeRUNDLL32.EXE

pid process

2316 rundll32.exe
2316 rundll32.exe
732 RUNDLL32.EXE
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
11	732	RUNDLL32.EXE

pid	process
2316	rundll32.exe

pid	process
2316	rundll32.exe
2316	rundll32.exe
732	RUNDLL32.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RUNDLL32.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exeRUNDLL32.EXEpowershell.exe

pid process

3936 powershell.exe
3936 powershell.exe
3936 powershell.exe
732 RUNDLL32.EXE
732 RUNDLL32.EXE
2768 powershell.exe
2768 powershell.exe
2768 powershell.exe

pid	process
3936	powershell.exe
3936	powershell.exe
3936	powershell.exe
732	RUNDLL32.EXE
732	RUNDLL32.EXE
2768	powershell.exe
2768	powershell.exe
2768	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

rundll32.exeRUNDLL32.EXEpowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeDebugPrivilege	732	RUNDLL32.EXE
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

RUNDLL32.EXE

pid process

732 RUNDLL32.EXE

pid	process
732	RUNDLL32.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

529d344142103e0620243e92caa08d5a.exerundll32.exeRUNDLL32.EXEpowershell.exe

description	pid	process	target process
PID 4056 wrote to memory of 2316	4056	529d344142103e0620243e92caa08d5a.exe	rundll32.exe
PID 4056 wrote to memory of 2316	4056	529d344142103e0620243e92caa08d5a.exe	rundll32.exe
PID 4056 wrote to memory of 2316	4056	529d344142103e0620243e92caa08d5a.exe	rundll32.exe
PID 2316 wrote to memory of 732	2316	rundll32.exe	RUNDLL32.EXE
PID 2316 wrote to memory of 732	2316	rundll32.exe	RUNDLL32.EXE
PID 2316 wrote to memory of 732	2316	rundll32.exe	RUNDLL32.EXE
PID 732 wrote to memory of 3936	732	RUNDLL32.EXE	powershell.exe
PID 732 wrote to memory of 3936	732	RUNDLL32.EXE	powershell.exe
PID 732 wrote to memory of 3936	732	RUNDLL32.EXE	powershell.exe
PID 732 wrote to memory of 2768	732	RUNDLL32.EXE	powershell.exe
PID 732 wrote to memory of 2768	732	RUNDLL32.EXE	powershell.exe
PID 732 wrote to memory of 2768	732	RUNDLL32.EXE	powershell.exe
PID 2768 wrote to memory of 2128	2768	powershell.exe	nslookup.exe
PID 2768 wrote to memory of 2128	2768	powershell.exe	nslookup.exe
PID 2768 wrote to memory of 2128	2768	powershell.exe	nslookup.exe
PID 732 wrote to memory of 1100	732	RUNDLL32.EXE	schtasks.exe
PID 732 wrote to memory of 1100	732	RUNDLL32.EXE	schtasks.exe
PID 732 wrote to memory of 1100	732	RUNDLL32.EXE	schtasks.exe
PID 732 wrote to memory of 2916	732	RUNDLL32.EXE	schtasks.exe
PID 732 wrote to memory of 2916	732	RUNDLL32.EXE	schtasks.exe
PID 732 wrote to memory of 2916	732	RUNDLL32.EXE	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\529d344142103e0620243e92caa08d5a.exe
"C:\Users\Admin\AppData\Local\Temp\529d344142103e0620243e92caa08d5a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\529D34~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\529D34~1.EXE
2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\529D34~1.DLL,OwswfI0u
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp8284.tmp.ps1"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp97B4.tmp.ps1"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\SysWOW64\nslookup.exe
"C:\Windows\system32\nslookup.exe" -type=any localhost
5⤵
PID:2128

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
4⤵
PID:1100

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
4⤵
PID:2916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
47eebe401625bbc55e75dbfb72e9e89a

SHA1
db3b2135942d2532c59b9788253638eb77e5995e

SHA256
f1cd56000c44bbdb6880b5b133731f493fe8cba8198c5a861da6ae7b489ed0c3

SHA512
590b149863d58be346e7927c28501375cc570858d2f156d234b03d68b86c5c0667a1038e2b6f6639172bf95638ca9f7c70f45270951abbcdf43b1be853b81d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
86b3e9961e776a956a6ed1751f615ccf

SHA1
3706b820062d7877fc9a828f97466ef65aea3866

SHA256
8f6246b7cfccd339e71be19c414cbc1aafd150db6dd0393930c940d22438d86f

SHA512
f4ba92435d02d5e8f218429444f4a6029e7d08a09ab4aaa4b340a059eabdd389e7d145e030f5ef7dfd442b8d06c0c9776a1819b18f1371f6d5e1c2ab0f5075c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\529D34~1.DLL
MD5
a28665deda765745b62e173f309928ae

SHA1
7446624192b1a836df97ead91c6ff105c50cf46f

SHA256
d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea

SHA512
091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8284.tmp.ps1
MD5
534c8c6dee6e0a32424e76838e829440

SHA1
67f0970a8c9f4a79e3e4ef65dbaa65aa741106ff

SHA256
c6be44e1009d018c47b337ef5d231a06d1d55df467fc3fde31b6c176b6b4b6d0

SHA512
c4c1d9c40f6d24aca37a32ce138f4c836d51c0adfcf8a065c68834f540a827fe620e47eca89bd765b3743f97761d2ec28869947efd60c7f0f528164e751e12b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8285.tmp
MD5
c416c12d1b2b1da8c8655e393b544362

SHA1
fb1a43cd8e1c556c2d25f361f42a21293c29e447

SHA256
0600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046

SHA512
cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp97B4.tmp.ps1
MD5
8045b0a19355a1f193ce97e9bb3581d1

SHA1
a5032725d3ac3e6207b68a495d33f24962e646fc

SHA256
010854d4cb98edfdb29a160d90d7674b8def28e378146ba963ac83e6f231af9b

SHA512
9e0536a75b4f8e76893acf6a03d75f117a59178c905e0731da197489fc5da6f0da55395c1c6fd9e2298c4c9f203b4f63f6cc719d3ab63b492258ff3eda4d78aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp97B5.tmp
MD5
1860260b2697808b80802352fe324782

SHA1
f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b

SHA256
0c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1

SHA512
d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f

Download Submit
\Users\Admin\AppData\Local\Temp\529D34~1.DLL
MD5
a28665deda765745b62e173f309928ae

SHA1
7446624192b1a836df97ead91c6ff105c50cf46f

SHA256
d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea

SHA512
091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf

Download Submit
\Users\Admin\AppData\Local\Temp\529D34~1.DLL
MD5
a28665deda765745b62e173f309928ae

SHA1
7446624192b1a836df97ead91c6ff105c50cf46f

SHA256
d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea

SHA512
091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf

Download Submit
\Users\Admin\AppData\Local\Temp\529D34~1.DLL
MD5
a28665deda765745b62e173f309928ae

SHA1
7446624192b1a836df97ead91c6ff105c50cf46f

SHA256
d2f45568fa6ac6c6d401ebe832592333d08e705a8e88f9382377af8a565574ea

SHA512
091c36ac8d6d624f010f19dd2ecceca68e8db4b6cdd5112151eb9edf4e2e2ed0808d6e889436af065d16b4623ad2d10e1e202b7ccb102ad9435006fc05a764bf

Download Submit
memory/732-123-0x0000000000000000-mapping.dmp

Download
memory/732-163-0x0000000003050000-0x0000000003051000-memory.dmp

Filesize
4KB

Download
memory/732-129-0x0000000005271000-0x00000000058CF000-memory.dmp

Filesize
6.4MB

Download
memory/1100-183-0x0000000000000000-mapping.dmp

Download
memory/2128-180-0x0000000000000000-mapping.dmp

Download
memory/2316-125-0x0000000004BA1000-0x00000000051FF000-memory.dmp

Filesize
6.4MB

Download
memory/2316-117-0x0000000000000000-mapping.dmp

Download
memory/2316-121-0x0000000004020000-0x00000000045DA000-memory.dmp

Filesize
5.7MB

Download
memory/2316-122-0x00000000046A0000-0x00000000046A1000-memory.dmp

Filesize
4KB

Download
memory/2316-126-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2768-155-0x0000000000000000-mapping.dmp

Download
memory/2768-184-0x0000000004DD3000-0x0000000004DD4000-memory.dmp

Filesize
4KB

Download
memory/2768-171-0x0000000008AE0000-0x0000000008AE1000-memory.dmp

Filesize
4KB

Download
memory/2768-168-0x00000000080E0000-0x00000000080E1000-memory.dmp

Filesize
4KB

Download
memory/2768-166-0x0000000004DD2000-0x0000000004DD3000-memory.dmp

Filesize
4KB

Download
memory/2768-164-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/2916-185-0x0000000000000000-mapping.dmp

Download
memory/3936-141-0x0000000007D60000-0x0000000007D61000-memory.dmp

Filesize
4KB

Download
memory/3936-143-0x0000000008640000-0x0000000008641000-memory.dmp

Filesize
4KB

Download
memory/3936-151-0x00000000092C0000-0x00000000092C1000-memory.dmp

Filesize
4KB

Download
memory/3936-152-0x00000000070E0000-0x00000000070E1000-memory.dmp

Filesize
4KB

Download
memory/3936-130-0x0000000000000000-mapping.dmp

Download
memory/3936-145-0x00000000086D0000-0x00000000086D1000-memory.dmp

Filesize
4KB

Download
memory/3936-133-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/3936-162-0x0000000006FA3000-0x0000000006FA4000-memory.dmp

Filesize
4KB

Download
memory/3936-135-0x00000000074B0000-0x00000000074B1000-memory.dmp

Filesize
4KB

Download
memory/3936-150-0x0000000009D30000-0x0000000009D31000-memory.dmp

Filesize
4KB

Download
memory/3936-142-0x00000000085F0000-0x00000000085F1000-memory.dmp

Filesize
4KB

Download
memory/3936-134-0x00000000075E0000-0x00000000075E1000-memory.dmp

Filesize
4KB

Download
memory/3936-140-0x0000000006FA2000-0x0000000006FA3000-memory.dmp

Filesize
4KB

Download
memory/3936-139-0x0000000006FA0000-0x0000000006FA1000-memory.dmp

Filesize
4KB

Download
memory/3936-138-0x0000000007E60000-0x0000000007E61000-memory.dmp

Filesize
4KB

Download
memory/3936-137-0x0000000007DF0000-0x0000000007DF1000-memory.dmp

Filesize
4KB

Download
memory/3936-136-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/4056-116-0x0000000003290000-0x00000000033DA000-memory.dmp

Filesize
1.3MB

Download
memory/4056-115-0x0000000000400000-0x0000000003149000-memory.dmp

Filesize
45.3MB

Download
memory/4056-114-0x0000000005460000-0x0000000005B54000-memory.dmp

Filesize
7.0MB

Download