Analysis
- max time kernel
142s - max time network
144s - platform
windows10_x64 - resource
win10v20210410 - submitted
25/05/2021, 07:16
General
- Target cd40719a2a4b343268739b3d711437f4.exe
- Size 6.0MB
- Sample210525-aba349pbjs
- SHA256 f49f273f3ee41c8bfebed6c87c839335ae6ee8faa025f6ab67b6f9aec1569604
Malware Config
Extracted
-
danabot
-
1827
-
3
-
184.95.51.183:443
-
184.95.51.175:443
-
192.210.198.12:443
-
184.95.51.180:443
-
embedded_hash
AEF96B4D339B580ABB737F203C2D0F52
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Blocklisted process makes network request 4 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd40719a2a4b343268739b3d711437f4.exe"C:\Users\Admin\AppData\Local\Temp\cd40719a2a4b343268739b3d711437f4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\CD4071~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\CD4071~1.EXE2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\CD4071~1.DLL,fFshZA==3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2600-122-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/2600-118-0x00000000043B0000-0x0000000004975000-memory.dmp
memory/2600-135-0x0000000000800000-0x00000000008AE000-memory.dmp
memory/2600-133-0x0000000004F11000-0x0000000005570000-memory.dmp
memory/3576-130-0x0000000004130000-0x00000000046F5000-memory.dmp
memory/3576-131-0x0000000004840000-0x0000000004841000-memory.dmp
memory/3576-137-0x0000000004CF1000-0x0000000005350000-memory.dmp
memory/4092-120-0x0000000000400000-0x0000000000B14000-memory.dmp
memory/4092-121-0x0000000000C00000-0x0000000000D4A000-memory.dmp
memory/4092-119-0x0000000002D60000-0x0000000003467000-memory.dmp