Analysis
- max time kernel
145s - max time network
119s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
15/11/2021, 09:05
General
- Target 4b92e211198e39a18bc6c86147e28963.exe
- Size 1.7MB
- Sample211115-k17nkshga4
- SHA256 e8fc104848a0052d2fedd753bd7e70f9cd3d81d286cf9a85c67f1cd604c74996
Score
10/10
Malware Config
Extracted
Family
-
danabot
C2
-
192.119.110.73:443
-
192.236.147.206:443
-
192.236.192.201:443
Attributes
-
embedded_hash
0FA95F120D6EB149A5D48E36BC76879D
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot Loader Component 4 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b92e211198e39a18bc6c86147e28963.exe"C:\Users\Admin\AppData\Local\Temp\4b92e211198e39a18bc6c86147e28963.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\4B92E2~1.DLL,s C:\Users\Admin\AppData\Local\Temp\4B92E2~1.EXE2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1608-125-0x0000000000C90000-0x0000000000F0C000-memory.dmp
memory/3160-118-0x0000000002500000-0x000000000268E000-memory.dmp
memory/3160-120-0x0000000000400000-0x00000000005C6000-memory.dmp
memory/3160-119-0x0000000002690000-0x0000000002835000-memory.dmp