Analysis
- max time kernel
135s - max time network
123s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
09/01/2022, 09:16
General
- Target 0347b84f4e3d0aa6a1009f509539e2b1.exe
- Size 1.1MB
- Sample220109-k8f6laddf2
- SHA256 1027b3f9e451a16896a4b06e851002ab01ca153421b17cbad6b0e73fac85ed4a
Score
10/10
Malware Config
Extracted
Family
-
danabot
Botnet
-
4
C2
-
192.119.110.4:443
-
192.236.194.72:443
Attributes
-
embedded_hash
422236FD601D11EE82825A484D26DD6F
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot Loader Component 4 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0347b84f4e3d0aa6a1009f509539e2b1.exe"C:\Users\Admin\AppData\Local\Temp\0347b84f4e3d0aa6a1009f509539e2b1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\0347b84f4e3d0aa6a1009f509539e2b1.exe.dll,z C:\Users\Admin\AppData\Local\Temp\0347b84f4e3d0aa6a1009f509539e2b1.exe2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2744-116-0x0000000004BB0000-0x0000000004CAA000-memory.dmp
memory/2744-115-0x0000000004AC0000-0x0000000004BA2000-memory.dmp
memory/2744-117-0x0000000000400000-0x0000000002C53000-memory.dmp
memory/3984-122-0x0000000003FD0000-0x000000000411D000-memory.dmp