Analysis

  • max time kernel
    143s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220715-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220715-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-07-2022 21:06

General

  • Target

    9D68E9449BCF593ABFD4562466A7CC2D35B1C33868E3B.exe

  • Size

    6.0MB

  • MD5

    5c0be4a5273dec6b3ebb180a90f337f2

  • SHA1

    3a82216a89310aa7b4cee1e58a3af7e16c0cce19

  • SHA256

    9d68e9449bcf593abfd4562466a7cc2d35b1c33868e3bcf0e47bda4d9fc78403

  • SHA512

    4e922ede66f69d3eb3f6baac3db20b0675df36ec60fd1d940c80e772b5fa28f8d85c68f9e1aa4d89a552d802ade54f762004f0e0eb2ed4b4f8dee8b6cbd0becc

Malware Config

Extracted

Family

danabot

Version

1765

Botnet

3

C2

192.3.26.98:443

192.3.26.107:443

192.161.48.5:443

192.236.146.203:443

Attributes
  • embedded_hash

    B2585F6479280F48B64C99F950BBF36D

  • type

    main

rsa_pubkey.plain
rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • suricata: ET MALWARE Danabot Key Exchange Request

    suricata: ET MALWARE Danabot Key Exchange Request

  • Blocklisted process makes network request 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9D68E9449BCF593ABFD4562466A7CC2D35B1C33868E3B.exe
    "C:\Users\Admin\AppData\Local\Temp\9D68E9449BCF593ABFD4562466A7CC2D35B1C33868E3B.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\9D68E9~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\9D68E9~1.EXE
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Windows\SysWOW64\RUNDLL32.EXE
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\9D68E9~1.DLL,h1cwTA==
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2716
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 508
      2⤵
      • Program crash
      PID:2696
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1876 -ip 1876
    1⤵
      PID:4544

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\9D68E9~1.DLL

      Filesize

      5.7MB

      MD5

      946d12b008eea3bd68748539717f5cdf

      SHA1

      f95d564aeba95034a10ac512636a6d674d5caee6

      SHA256

      98419ef86ab46a5216a5c1f8da708ad554c71474438bd232f6dc15a9415d361d

      SHA512

      2a50a0918fa597f386aa1ecbf927fcc5b69c79c9d934575f1cb7bc7117d2aca07845e0b9485c0800ecc96f4a055467d81b92e069517cae5d58a947f1ee6a0b28

    • C:\Users\Admin\AppData\Local\Temp\9D68E9~1.EXE.dll

      Filesize

      5.7MB

      MD5

      946d12b008eea3bd68748539717f5cdf

      SHA1

      f95d564aeba95034a10ac512636a6d674d5caee6

      SHA256

      98419ef86ab46a5216a5c1f8da708ad554c71474438bd232f6dc15a9415d361d

      SHA512

      2a50a0918fa597f386aa1ecbf927fcc5b69c79c9d934575f1cb7bc7117d2aca07845e0b9485c0800ecc96f4a055467d81b92e069517cae5d58a947f1ee6a0b28

    • C:\Users\Admin\AppData\Local\Temp\9D68E9~1.EXE.dll

      Filesize

      5.7MB

      MD5

      946d12b008eea3bd68748539717f5cdf

      SHA1

      f95d564aeba95034a10ac512636a6d674d5caee6

      SHA256

      98419ef86ab46a5216a5c1f8da708ad554c71474438bd232f6dc15a9415d361d

      SHA512

      2a50a0918fa597f386aa1ecbf927fcc5b69c79c9d934575f1cb7bc7117d2aca07845e0b9485c0800ecc96f4a055467d81b92e069517cae5d58a947f1ee6a0b28

    • C:\Users\Admin\AppData\Local\Temp\9D68E9~1.EXE.dll

      Filesize

      5.7MB

      MD5

      946d12b008eea3bd68748539717f5cdf

      SHA1

      f95d564aeba95034a10ac512636a6d674d5caee6

      SHA256

      98419ef86ab46a5216a5c1f8da708ad554c71474438bd232f6dc15a9415d361d

      SHA512

      2a50a0918fa597f386aa1ecbf927fcc5b69c79c9d934575f1cb7bc7117d2aca07845e0b9485c0800ecc96f4a055467d81b92e069517cae5d58a947f1ee6a0b28

    • C:\Users\Admin\AppData\Local\Temp\9D68E9~1.EXE.dll

      Filesize

      5.7MB

      MD5

      946d12b008eea3bd68748539717f5cdf

      SHA1

      f95d564aeba95034a10ac512636a6d674d5caee6

      SHA256

      98419ef86ab46a5216a5c1f8da708ad554c71474438bd232f6dc15a9415d361d

      SHA512

      2a50a0918fa597f386aa1ecbf927fcc5b69c79c9d934575f1cb7bc7117d2aca07845e0b9485c0800ecc96f4a055467d81b92e069517cae5d58a947f1ee6a0b28

    • memory/1876-149-0x0000000000400000-0x0000000000DED000-memory.dmp

      Filesize

      9.9MB

    • memory/1876-130-0x0000000002F06000-0x00000000034C3000-memory.dmp

      Filesize

      5.7MB

    • memory/1876-132-0x0000000000400000-0x0000000000DED000-memory.dmp

      Filesize

      9.9MB

    • memory/1876-147-0x00000000034D0000-0x0000000003BC7000-memory.dmp

      Filesize

      7.0MB

    • memory/1876-131-0x00000000034D0000-0x0000000003BC7000-memory.dmp

      Filesize

      7.0MB

    • memory/1876-148-0x0000000002F06000-0x00000000034C3000-memory.dmp

      Filesize

      5.7MB

    • memory/2392-137-0x00000000028A0000-0x0000000002E5C000-memory.dmp

      Filesize

      5.7MB

    • memory/2392-138-0x0000000003570000-0x0000000003BD2000-memory.dmp

      Filesize

      6.4MB

    • memory/2392-139-0x0000000003570000-0x0000000003BD2000-memory.dmp

      Filesize

      6.4MB

    • memory/2392-144-0x0000000003570000-0x0000000003BD2000-memory.dmp

      Filesize

      6.4MB

    • memory/2716-146-0x00000000034F0000-0x0000000003B52000-memory.dmp

      Filesize

      6.4MB

    • memory/2716-145-0x00000000034F0000-0x0000000003B52000-memory.dmp

      Filesize

      6.4MB

    • memory/2716-143-0x00000000026D0000-0x0000000002C8C000-memory.dmp

      Filesize

      5.7MB

    • memory/2716-150-0x00000000034F0000-0x0000000003B52000-memory.dmp

      Filesize

      6.4MB