Analysis
- max time kernel
138s - max time network
141s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
16/12/2021, 21:27
General
- Target 89ef7342084bacafe1bbfc65ffc7f705.exe
- Size 1.8MB
- Sample211216-1aqv5sche4
- SHA256 1cdb8bfb8075c1e1c1bd93987ec457a83a2e8af4e98e3fb7dfc1d3a25db71037
Score
10/10
Malware Config
Extracted
Family
-
danabot
Botnet
-
4
C2
-
142.11.244.223:443
-
23.106.122.139:443
Attributes
-
embedded_hash
0FA95F120D6EB149A5D48E36BC76879D
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot Loader Component 4 IoCs
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Loads dropped DLL 2 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\89ef7342084bacafe1bbfc65ffc7f705.exe"C:\Users\Admin\AppData\Local\Temp\89ef7342084bacafe1bbfc65ffc7f705.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\89EF73~1.DLL,s C:\Users\Admin\AppData\Local\Temp\89EF73~1.EXE2⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 5482⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3596-115-0x00000000022E3000-0x0000000002471000-memory.dmp
memory/3596-117-0x0000000000400000-0x0000000000657000-memory.dmp
memory/3596-116-0x0000000002480000-0x0000000002625000-memory.dmp
memory/4408-122-0x00000000042A0000-0x000000000451B000-memory.dmp