Analysis
- max time kernel
150s - max time network
152s - platform
windows7_x64 - resource
win7v20210408 - submitted
01/10/2021, 06:48
General
- Target 7927f5cb81ae68172215ab93c41f2b99.exe
- Size 1.1MB
- Sample211001-hkshlsbaf3
- SHA256 be62bd296d68f4ffcdb03f51859d8a10cab786435812842679e594564ebafe5f
Score
10/10
Malware Config
Extracted
Family
-
danabot
C2
-
142.11.192.232:443
-
192.119.110.73:443
-
142.11.242.31:443
-
192.210.222.88:443
Attributes
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
rsa_pubkey.plain
rsa_privkey.plain
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot Loader Component 6 IoCs
- Blocklisted process makes network request 1 IoCs
- Loads dropped DLL 4 IoCs
- Drops file in Program Files directory 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7927f5cb81ae68172215ab93c41f2b99.exe"C:\Users\Admin\AppData\Local\Temp\7927f5cb81ae68172215ab93c41f2b99.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\7927F5~1.DLL,s C:\Users\Admin\AppData\Local\Temp\7927F5~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1920-60-0x0000000076691000-0x0000000076693000-memory.dmp
memory/1920-63-0x0000000000B00000-0x0000000000C07000-memory.dmp
memory/1920-64-0x0000000000400000-0x000000000094C000-memory.dmp
memory/1940-70-0x0000000002040000-0x00000000021A4000-memory.dmp