danabot | c3a37f9ca1adb4ac16434269e909bbc87fe684cfaf414473ecd8edc499e59fc5

Analysis

max time kernel
130s
max time network
111s
platform
windows10_x64
resource
win10v20210408
submitted
28-04-2021 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

748e0ead4f83adb0e998badcc9162b9b.exe
Size

5.9MB
MD5

748e0ead4f83adb0e998badcc9162b9b
SHA1

ace1bba4c0e96cb82ba4dd9b9fbe53e944ebcc83
SHA256

c3a37f9ca1adb4ac16434269e909bbc87fe684cfaf414473ecd8edc499e59fc5
SHA512

151ca0c9ff17ff09fa436ba9892949fe67d4f20cac11be59235c9a5d5fee604a459f57a638202b325fb205a7cf2147032d4d73b010cd54ca76df8d2ff51d54d8

Score

10^/10

danabot 3 banker discovery spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1827

Botnet

192.236.147.83:443

184.95.51.175:443

23.106.123.185:443

192.210.198.12:443

Attributes

embedded_hash
AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 1 IoCs

Processes:

RUNDLL32.EXE

flow pid process

10 2836 RUNDLL32.EXE
Deletes itself 1 IoCs

Processes:

rundll32.exe

pid process

3772 rundll32.exe
Loads dropped DLL 3 IoCs

Processes:

rundll32.exeRUNDLL32.EXE

pid process

3772 rundll32.exe
2836 RUNDLL32.EXE
2836 RUNDLL32.EXE
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
10	2836	RUNDLL32.EXE

pid	process
3772	rundll32.exe

pid	process
3772	rundll32.exe
2836	RUNDLL32.EXE
2836	RUNDLL32.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RUNDLL32.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RUNDLL32.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exeRUNDLL32.EXEpowershell.exe

pid process

3692 powershell.exe
3692 powershell.exe
3692 powershell.exe
2836 RUNDLL32.EXE
2836 RUNDLL32.EXE
736 powershell.exe
736 powershell.exe
736 powershell.exe

pid	process
3692	powershell.exe
3692	powershell.exe
3692	powershell.exe
2836	RUNDLL32.EXE
2836	RUNDLL32.EXE
736	powershell.exe
736	powershell.exe
736	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

rundll32.exeRUNDLL32.EXEpowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3772	rundll32.exe
Token: SeDebugPrivilege	2836	RUNDLL32.EXE
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

RUNDLL32.EXE

pid process

2836 RUNDLL32.EXE

pid	process
2836	RUNDLL32.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

748e0ead4f83adb0e998badcc9162b9b.exerundll32.exeRUNDLL32.EXEpowershell.exe

description	pid	process	target process
PID 908 wrote to memory of 3772	908	748e0ead4f83adb0e998badcc9162b9b.exe	rundll32.exe
PID 908 wrote to memory of 3772	908	748e0ead4f83adb0e998badcc9162b9b.exe	rundll32.exe
PID 908 wrote to memory of 3772	908	748e0ead4f83adb0e998badcc9162b9b.exe	rundll32.exe
PID 3772 wrote to memory of 2836	3772	rundll32.exe	RUNDLL32.EXE
PID 3772 wrote to memory of 2836	3772	rundll32.exe	RUNDLL32.EXE
PID 3772 wrote to memory of 2836	3772	rundll32.exe	RUNDLL32.EXE
PID 2836 wrote to memory of 3692	2836	RUNDLL32.EXE	powershell.exe
PID 2836 wrote to memory of 3692	2836	RUNDLL32.EXE	powershell.exe
PID 2836 wrote to memory of 3692	2836	RUNDLL32.EXE	powershell.exe
PID 2836 wrote to memory of 736	2836	RUNDLL32.EXE	powershell.exe
PID 2836 wrote to memory of 736	2836	RUNDLL32.EXE	powershell.exe
PID 2836 wrote to memory of 736	2836	RUNDLL32.EXE	powershell.exe
PID 736 wrote to memory of 3824	736	powershell.exe	nslookup.exe
PID 736 wrote to memory of 3824	736	powershell.exe	nslookup.exe
PID 736 wrote to memory of 3824	736	powershell.exe	nslookup.exe
PID 2836 wrote to memory of 2160	2836	RUNDLL32.EXE	schtasks.exe
PID 2836 wrote to memory of 2160	2836	RUNDLL32.EXE	schtasks.exe
PID 2836 wrote to memory of 2160	2836	RUNDLL32.EXE	schtasks.exe
PID 2836 wrote to memory of 1292	2836	RUNDLL32.EXE	schtasks.exe
PID 2836 wrote to memory of 1292	2836	RUNDLL32.EXE	schtasks.exe
PID 2836 wrote to memory of 1292	2836	RUNDLL32.EXE	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\748e0ead4f83adb0e998badcc9162b9b.exe
"C:\Users\Admin\AppData\Local\Temp\748e0ead4f83adb0e998badcc9162b9b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\748E0E~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\748E0E~1.EXE
2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\748E0E~1.DLL,JiQCfI2I
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpC53A.tmp.ps1"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp15DC.tmp.ps1"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\nslookup.exe
"C:\Windows\system32\nslookup.exe" -type=any localhost
5⤵
PID:3824

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
4⤵
PID:2160

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
4⤵
PID:1292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
47eebe401625bbc55e75dbfb72e9e89a

SHA1
db3b2135942d2532c59b9788253638eb77e5995e

SHA256
f1cd56000c44bbdb6880b5b133731f493fe8cba8198c5a861da6ae7b489ed0c3

SHA512
590b149863d58be346e7927c28501375cc570858d2f156d234b03d68b86c5c0667a1038e2b6f6639172bf95638ca9f7c70f45270951abbcdf43b1be853b81d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
6dc4cb679389ca2e29127a2c7ebbb89d

SHA1
a85ca67f4a886e905d0f1f771dccce9f3cc42aa4

SHA256
5ae1f32b3e1389346e474986b29fb245a0d1fe66c293c820b6455f313e93a540

SHA512
2f9f869c4ed411a3cbcece6a7267eaceea22fd163cea47090504d8c72b7318a6a40b25a27a3473f97c2478dcee9c2167911e54a17a6687b835861627d5596fde

Download Submit
C:\Users\Admin\AppData\Local\Temp\748E0E~1.DLL
MD5
c7d52f79e6179ec79a4f7d16dc6e4b38

SHA1
c0bdfe14f5a2f3e12d4a35918dcd2084d134c1c4

SHA256
931e5d02b19cba39335b620eaa088200dbcbd74715141335795206a85d2c94d4

SHA512
3e802c612b2eb5a23745967d24e542e85d2e2ed04919f53a8a6b4c3932efe94fe70165f66826a459a383a1b08c5cc872fd1f04816a63ab7cedd2496506d55729

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp15DC.tmp.ps1
MD5
13758daf8adde4f837611f5634bc9efc

SHA1
04f597d45deb31f4ccc0ff699a4ac88b940abb60

SHA256
f2b4fa3f51cebd714291dfe9c386ad3a7860aa5249d80e3933044dd9e6200d41

SHA512
b566a8545eabf0371e6c27eb014a011844a23562107d38bfdf2df24b0fbbabb877340f561f175dc8746b1c318415df12e89a99455e2f566509945eb887aa56ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp15DD.tmp
MD5
1860260b2697808b80802352fe324782

SHA1
f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b

SHA256
0c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1

SHA512
d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC53A.tmp.ps1
MD5
0af79ad87403661aa7a2c2ee6ad14666

SHA1
413132842b0eed11f509ec37b0bdc95ce336572b

SHA256
f4c482fa8ab05a9024e18fa4a89b3c2f3de1dfa09bd475e13592be9d725dfafc

SHA512
3bd74f3471f0f67da888262b55a0f524f13a512ca805edbbd9fe9e6505a0f2e4c9bb732a3df35bc4b0f271eaee504eef7e0a9cd4cbe46b20c0326e238e786357

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC53B.tmp
MD5
c416c12d1b2b1da8c8655e393b544362

SHA1
fb1a43cd8e1c556c2d25f361f42a21293c29e447

SHA256
0600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046

SHA512
cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c

Download Submit
\Users\Admin\AppData\Local\Temp\748E0E~1.DLL
MD5
c7d52f79e6179ec79a4f7d16dc6e4b38

SHA1
c0bdfe14f5a2f3e12d4a35918dcd2084d134c1c4

SHA256
931e5d02b19cba39335b620eaa088200dbcbd74715141335795206a85d2c94d4

SHA512
3e802c612b2eb5a23745967d24e542e85d2e2ed04919f53a8a6b4c3932efe94fe70165f66826a459a383a1b08c5cc872fd1f04816a63ab7cedd2496506d55729

Download Submit
\Users\Admin\AppData\Local\Temp\748E0E~1.DLL
MD5
c7d52f79e6179ec79a4f7d16dc6e4b38

SHA1
c0bdfe14f5a2f3e12d4a35918dcd2084d134c1c4

SHA256
931e5d02b19cba39335b620eaa088200dbcbd74715141335795206a85d2c94d4

SHA512
3e802c612b2eb5a23745967d24e542e85d2e2ed04919f53a8a6b4c3932efe94fe70165f66826a459a383a1b08c5cc872fd1f04816a63ab7cedd2496506d55729

Download Submit
\Users\Admin\AppData\Local\Temp\748E0E~1.DLL
MD5
c7d52f79e6179ec79a4f7d16dc6e4b38

SHA1
c0bdfe14f5a2f3e12d4a35918dcd2084d134c1c4

SHA256
931e5d02b19cba39335b620eaa088200dbcbd74715141335795206a85d2c94d4

SHA512
3e802c612b2eb5a23745967d24e542e85d2e2ed04919f53a8a6b4c3932efe94fe70165f66826a459a383a1b08c5cc872fd1f04816a63ab7cedd2496506d55729

Download Submit
memory/736-167-0x00000000050E2000-0x00000000050E3000-memory.dmp

Filesize
4KB

Download
memory/736-183-0x00000000050E3000-0x00000000050E4000-memory.dmp

Filesize
4KB

Download
memory/736-156-0x0000000000000000-mapping.dmp

Download
memory/736-171-0x0000000008DF0000-0x0000000008DF1000-memory.dmp

Filesize
4KB

Download
memory/736-168-0x0000000008450000-0x0000000008451000-memory.dmp

Filesize
4KB

Download
memory/736-166-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/908-115-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/908-114-0x00000000030C0000-0x00000000037B6000-memory.dmp

Filesize
7.0MB

Download
memory/908-116-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/1292-185-0x0000000000000000-mapping.dmp

Download
memory/2160-184-0x0000000000000000-mapping.dmp

Download
memory/2836-126-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/2836-164-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2836-122-0x0000000000000000-mapping.dmp

Download
memory/2836-125-0x0000000004200000-0x00000000047BA000-memory.dmp

Filesize
5.7MB

Download
memory/2836-129-0x0000000004E11000-0x0000000005470000-memory.dmp

Filesize
6.4MB

Download
memory/3692-140-0x0000000008200000-0x0000000008201000-memory.dmp

Filesize
4KB

Download
memory/3692-137-0x0000000007930000-0x0000000007931000-memory.dmp

Filesize
4KB

Download
memory/3692-150-0x000000000A0D0000-0x000000000A0D1000-memory.dmp

Filesize
4KB

Download
memory/3692-151-0x0000000008AF0000-0x0000000008AF1000-memory.dmp

Filesize
4KB

Download
memory/3692-152-0x0000000008C80000-0x0000000008C81000-memory.dmp

Filesize
4KB

Download
memory/3692-143-0x0000000008950000-0x0000000008951000-memory.dmp

Filesize
4KB

Download
memory/3692-155-0x0000000007373000-0x0000000007374000-memory.dmp

Filesize
4KB

Download
memory/3692-142-0x00000000085D0000-0x00000000085D1000-memory.dmp

Filesize
4KB

Download
memory/3692-141-0x00000000078D0000-0x00000000078D1000-memory.dmp

Filesize
4KB

Download
memory/3692-139-0x0000000008190000-0x0000000008191000-memory.dmp

Filesize
4KB

Download
memory/3692-138-0x0000000008120000-0x0000000008121000-memory.dmp

Filesize
4KB

Download
memory/3692-145-0x00000000089D0000-0x00000000089D1000-memory.dmp

Filesize
4KB

Download
memory/3692-136-0x0000000007372000-0x0000000007373000-memory.dmp

Filesize
4KB

Download
memory/3692-135-0x00000000079B0000-0x00000000079B1000-memory.dmp

Filesize
4KB

Download
memory/3692-134-0x0000000007370000-0x0000000007371000-memory.dmp

Filesize
4KB

Download
memory/3692-133-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/3692-130-0x0000000000000000-mapping.dmp

Download
memory/3772-128-0x0000000003180000-0x0000000003181000-memory.dmp

Filesize
4KB

Download
memory/3772-127-0x0000000005141000-0x00000000057A0000-memory.dmp

Filesize
6.4MB

Download
memory/3772-117-0x0000000000000000-mapping.dmp

Download
memory/3824-180-0x0000000000000000-mapping.dmp

Download