Analysis
- max time kernel
81s - max time network
122s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
05/10/2021, 03:45
General
- Target ed3dd342054d04d320ddba1d821c53dd.exe
- Size 1.1MB
- Sample211005-ea3daahdhn
- SHA256 babcbf266a1bbb8c6ce3f339d767abb78821c0d71663186dafe7ada1da74e118
Malware Config
Extracted
-
danabot
-
142.11.242.31:443
-
192.119.110.73:443
-
192.210.222.88:443
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
-
type
loader
Extracted
-
danabot
-
2052
-
4
-
142.11.242.31:443
-
192.119.110.73:443
-
192.210.222.88:443
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
-
type
main
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot Loader Component 8 IoCs
- Blocklisted process makes network request 2 IoCs
- Loads dropped DLL 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 42 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed3dd342054d04d320ddba1d821c53dd.exe"C:\Users\Admin\AppData\Local\Temp\ed3dd342054d04d320ddba1d821c53dd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ED3DD3~1.DLL,s C:\Users\Admin\AppData\Local\Temp\ED3DD3~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\ED3DD3~1.DLL,TEoCNUE23⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\ED3DD3~1.DLL4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\ED3DD3~1.DLL,kjtW4⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 196385⤵
-
C:\Windows\system32\ctfmon.exectfmon.exe6⤵
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpC758.tmp.ps1"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpAAD.tmp.ps1"4⤵
-
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\system32\nslookup.exe" -type=any localhost5⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask4⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/800-166-0x0000000007BB0000-0x0000000007BB1000-memory.dmp
memory/800-202-0x000000007E860000-0x000000007E861000-memory.dmp
memory/800-430-0x00000000094A0000-0x00000000094A1000-memory.dmp
memory/800-147-0x0000000007410000-0x0000000007411000-memory.dmp
memory/800-146-0x00000000047C0000-0x00000000047C1000-memory.dmp
memory/800-148-0x0000000006DD0000-0x0000000006DD1000-memory.dmp
memory/800-149-0x0000000006DD2000-0x0000000006DD3000-memory.dmp
memory/800-438-0x0000000009490000-0x0000000009491000-memory.dmp
memory/800-211-0x0000000006DD3000-0x0000000006DD4000-memory.dmp
memory/800-155-0x0000000007220000-0x0000000007221000-memory.dmp
memory/800-209-0x00000000095B0000-0x00000000095B1000-memory.dmp
memory/800-206-0x00000000091C0000-0x00000000091C1000-memory.dmp
memory/800-199-0x0000000006EB0000-0x0000000006EB1000-memory.dmp
memory/800-191-0x0000000009090000-0x00000000090C3000-memory.dmp
memory/800-165-0x00000000072D0000-0x00000000072D1000-memory.dmp
memory/800-163-0x0000000007B40000-0x0000000007B41000-memory.dmp
memory/800-175-0x0000000008380000-0x0000000008381000-memory.dmp
memory/800-169-0x0000000008000000-0x0000000008001000-memory.dmp
memory/800-168-0x00000000073E0000-0x00000000073E1000-memory.dmp
memory/3236-223-0x0000000009B60000-0x0000000009B61000-memory.dmp
memory/3236-179-0x0000000004A92000-0x0000000004A93000-memory.dmp
memory/3236-173-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/3236-258-0x0000000004A93000-0x0000000004A94000-memory.dmp
memory/3236-243-0x00000000084C0000-0x00000000084C1000-memory.dmp
memory/3236-203-0x0000000006F40000-0x0000000006F41000-memory.dmp
memory/3236-225-0x00000000090F0000-0x00000000090F1000-memory.dmp
memory/3472-118-0x0000000000F90000-0x0000000001097000-memory.dmp
memory/3472-119-0x0000000000400000-0x0000000000951000-memory.dmp
memory/3476-126-0x0000000004F50000-0x0000000005F35000-memory.dmp
memory/4052-159-0x0000000004860000-0x0000000005845000-memory.dmp
memory/4052-144-0x0000000004270000-0x00000000043D5000-memory.dmp
memory/4052-161-0x0000000000790000-0x0000000000791000-memory.dmp
memory/4052-150-0x00000000059A0000-0x00000000059A1000-memory.dmp
memory/4196-132-0x0000000002C50000-0x0000000002C51000-memory.dmp
memory/4196-130-0x0000000002AD0000-0x0000000002C35000-memory.dmp
memory/4196-137-0x0000000004A90000-0x0000000005A75000-memory.dmp
memory/4440-162-0x0000000000580000-0x0000000000720000-memory.dmp
memory/4440-160-0x000001C5AF970000-0x000001C5AFB22000-memory.dmp
memory/5036-362-0x0000000007152000-0x0000000007153000-memory.dmp
memory/5036-360-0x0000000007150000-0x0000000007151000-memory.dmp
memory/5036-453-0x0000000007153000-0x0000000007154000-memory.dmp