Analysis
- max time kernel
120s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
19/10/2021, 15:01
General
- Target 8f15fa6ef37a36b927a274b88cb51a64.exe
- Size 1.2MB
- Sample211019-sdwa2aghhm
- SHA256 d84965a8eecfbc8c1bd466ecb91ffc30895a050c5b70fbba5beb30de498a30b4
Score
10/10
Malware Config
Extracted
Family
-
danabot
C2
-
192.119.110.73:443
-
192.236.147.159:443
-
192.210.222.88:443
Attributes
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
-
type
loader
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot Loader Component 4 IoCs
- Blocklisted process makes network request 1 IoCs
- Loads dropped DLL 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f15fa6ef37a36b927a274b88cb51a64.exe"C:\Users\Admin\AppData\Local\Temp\8f15fa6ef37a36b927a274b88cb51a64.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\8F15FA~1.DLL,s C:\Users\Admin\AppData\Local\Temp\8F15FA~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/948-122-0x0000000000BD0000-0x0000000000D31000-memory.dmp
memory/2720-115-0x0000000004EEC000-0x0000000004FDA000-memory.dmp
memory/2720-116-0x0000000004FE0000-0x00000000050E5000-memory.dmp
memory/2720-118-0x0000000000400000-0x0000000002FF1000-memory.dmp