Overview

overview

10

Static

static

3168462b40...ec.exe

windows7_x64

10

3168462b40...ec.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    134s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    26-02-2022 09:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3168462b40b11698b32fa1f90b8d684cba056ff88837ad67efad1d203641deec.exe

  • Size

    979KB

  • MD5

    adc8c26038ab606b280ce3ea693b5bc4

  • SHA1

    b2a2a0c749adb844e94b33c141e3044387b688b2

  • SHA256

    3168462b40b11698b32fa1f90b8d684cba056ff88837ad67efad1d203641deec

  • SHA512

    d0e46ebf72244663c58a320d81e631f731a3ab84bd9e9be05e69259fa0d7166d6213b9c61e4f8e6dde0400f94a92afdbcee36190d97ef141e0ec4cad7797c70c

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

5.61.58.130

2.56.213.39

2.56.212.4

5.61.56.192
rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Danabot x86 payload 3 IoCs

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3168462b40b11698b32fa1f90b8d684cba056ff88837ad67efad1d203641deec.exe
    "C:\Users\Admin\AppData\Local\Temp\3168462b40b11698b32fa1f90b8d684cba056ff88837ad67efad1d203641deec.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\316846~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\316846~1.EXE@1916
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\316846~1.DLL,f0
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:2624
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 460
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1684
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1916 -ip 1916
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:1148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3168462b40b11698b32fa1f90b8d684cba056ff88837ad67efad1d203641deec.dll
    MD5

    8055973bd2fde1486a90b5e956c8dba3

    SHA1

    932aa701e1402e957db8677db5e56b9162ccc12b

    SHA256

    a7a764414712bf2cc09bebe1b8e7dd257fbe7242c4fc103dd7f5876391af0337

    SHA512

    01bfb8bdb89a043fc77a6ea14276eac59d42dd0eb42f095728733b4be5809ac06e388b62483c8440a43422922e484acfc43c2618e98d288765231fe143cab52b

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\3168462b40b11698b32fa1f90b8d684cba056ff88837ad67efad1d203641deec.dll
    MD5

    8055973bd2fde1486a90b5e956c8dba3

    SHA1

    932aa701e1402e957db8677db5e56b9162ccc12b

    SHA256

    a7a764414712bf2cc09bebe1b8e7dd257fbe7242c4fc103dd7f5876391af0337

    SHA512

    01bfb8bdb89a043fc77a6ea14276eac59d42dd0eb42f095728733b4be5809ac06e388b62483c8440a43422922e484acfc43c2618e98d288765231fe143cab52b

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\316846~1.DLL
    MD5

    8055973bd2fde1486a90b5e956c8dba3

    SHA1

    932aa701e1402e957db8677db5e56b9162ccc12b

    SHA256

    a7a764414712bf2cc09bebe1b8e7dd257fbe7242c4fc103dd7f5876391af0337

    SHA512

    01bfb8bdb89a043fc77a6ea14276eac59d42dd0eb42f095728733b4be5809ac06e388b62483c8440a43422922e484acfc43c2618e98d288765231fe143cab52b

    Download Submit
  • memory/1916-130-0x0000000002F70000-0x000000000303B000-memory.dmp
    Filesize

    812KB

    Download
  • memory/1916-131-0x0000000003040000-0x0000000003121000-memory.dmp
    Filesize

    900KB

    Download
  • memory/1916-132-0x0000000000400000-0x00000000004ED000-memory.dmp
    Filesize

    948KB

    Download