Overview

overview

10

Static

static

mamsi.dll

windows7_x64

10

mamsi.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    4294187s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    10-03-2022 19:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    mamsi.dll

  • Size

    7.4MB

  • MD5

    ad68f2e6403621fe5b531b667a2035c5

  • SHA1

    42f73eb2dafa5cb0f9dae2e7bf3ae168f8ea5ff5

  • SHA256

    5443468cbcd380d17bcbfac400205bb81eb921354a918a011dd11f24bfe7a3d6

  • SHA512

    4f6416a8ec0c168e345bb51787281df0b92db0685da52348d191d708ae4c60e0207f2928277b53d3f0726f01c2d9dc31af07ce1167d3b3f7ae7b73e34e8ed451

Score
10/10
danabot21bankerdiscoveryspywarestealersuricatatrojan

Malware Config

Extracted

Family

danabot

Version

1755

Botnet

21

C2

47.254.174.158:1024

159.89.114.62:443

47.254.247.133:443

138.197.139.56:443
Attributes
  • embedded_hash

    9C7D6A0C33FE7EDD9922FFD6D97552CA

  • type

    main

rsa_pubkey.plain
rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • suricata: ET MALWARE Danabot Key Exchange Request

    suricata: ET MALWARE Danabot Key Exchange Request

    suricata
  • Blocklisted process makes network request 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\mamsi.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\mamsi.dll
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\SysWOW64\RUNDLL32.EXE
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\mamsi.dll,XTMqZBL1
        3⤵
        • Blocklisted process makes network request
        • Drops desktop.ini file(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:1456
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2000
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1052
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1828
      • C:\Windows\system32\rundll32.exe
        rundll32.exe mamsi.dll,aVUU
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1996
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe mamsi.dll,aVUU
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1604

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1456-64-0x0000000001F20000-0x0000000002699000-memory.dmp
      Filesize

      7.5MB

      Download
    • memory/1456-68-0x00000000034A0000-0x0000000003AFE000-memory.dmp
      Filesize

      6.4MB

      Download
    • memory/1456-67-0x0000000001F20000-0x0000000002699000-memory.dmp
      Filesize

      7.5MB

      Download
    • memory/1456-66-0x0000000003BD0000-0x0000000003BD1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1456-65-0x00000000034A0000-0x0000000003AFE000-memory.dmp
      Filesize

      6.4MB

      Download
    • memory/1604-70-0x0000000001F20000-0x0000000002699000-memory.dmp
      Filesize

      7.5MB

      Download
    • memory/1604-71-0x00000000035E0000-0x0000000003C3E000-memory.dmp
      Filesize

      6.4MB

      Download
    • memory/1604-72-0x0000000003D90000-0x0000000003D91000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1604-73-0x0000000001F20000-0x0000000002699000-memory.dmp
      Filesize

      7.5MB

      Download
    • memory/1604-74-0x00000000035E0000-0x0000000003C3E000-memory.dmp
      Filesize

      6.4MB

      Download
    • memory/1820-62-0x00000000036A0000-0x0000000003CFE000-memory.dmp
      Filesize

      6.4MB

      Download
    • memory/1820-61-0x00000000036A0000-0x0000000003CFE000-memory.dmp
      Filesize

      6.4MB

      Download
    • memory/1820-59-0x0000000001FE0000-0x0000000002759000-memory.dmp
      Filesize

      7.5MB

      Download
    • memory/1820-58-0x0000000000100000-0x0000000000101000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1820-57-0x0000000001FE0000-0x0000000002759000-memory.dmp
      Filesize

      7.5MB

      Download
    • memory/1820-56-0x0000000075CA1000-0x0000000075CA3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1916-54-0x000007FEFBA61000-0x000007FEFBA63000-memory.dmp
      Filesize

      8KB

      Download