Resubmissions
09/01/2022, 14:33
220109-rwxq5sdhcr1009/01/2022, 14:06
220109-rejg7aded71009/01/2022, 08:20
220109-j8fz6addd910Analysis
- max time kernel
151s - max time network
134s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
09/01/2022, 08:20
General
- Target 59ddabdcb5b43bbc66bbec89123d2627.exe
- Size 265KB
- Sample220109-j8fz6addd9
- SHA256 2d0bd38ea59864cdcd710759abea3f670449eb4505b54c8a8d22128691deefc1
Malware Config
Extracted
-
smokeloader
-
2020
-
http://nahbleiben.at/upload/
-
http://noblecreativeaz.com/upload/
-
http://tvqaq.cn/upload/
-
http://recmaster.ru/upload/
-
http://sovels.ru/upload/
Extracted
-
danabot
-
4
-
192.119.110.4:443
-
103.175.16.113:443
-
embedded_hash
422236FD601D11EE82825A484D26DD6F
-
type
loader
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot Loader Component 6 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\59ddabdcb5b43bbc66bbec89123d2627.exe"C:\Users\Admin\AppData\Local\Temp\59ddabdcb5b43bbc66bbec89123d2627.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E8E5.exeC:\Users\Admin\AppData\Local\Temp\E8E5.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\E8E5.exe.dll,z C:\Users\Admin\AppData\Local\Temp\E8E5.exe2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\6BF.exeC:\Users\Admin\AppData\Local\Temp\6BF.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6BF.exe.dll,z C:\Users\Admin\AppData\Local\Temp\6BF.exe2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1416-128-0x0000000000400000-0x0000000002C54000-memory.dmp
memory/2072-118-0x0000000000DF0000-0x0000000000E06000-memory.dmp
memory/2276-123-0x0000000004AA0000-0x0000000004B9C000-memory.dmp
memory/2276-122-0x00000000049B0000-0x0000000004A94000-memory.dmp
memory/2276-124-0x0000000000400000-0x0000000002C54000-memory.dmp
memory/2636-133-0x00000000041A0000-0x00000000042F1000-memory.dmp
memory/3556-115-0x0000000002B80000-0x0000000002CCA000-memory.dmp
memory/3556-116-0x0000000002B80000-0x0000000002CCA000-memory.dmp
memory/3556-117-0x0000000000400000-0x0000000002B79000-memory.dmp