Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
-
submitted
11/09/2022, 00:11
General
-
Target
de4310ebfe29b453df0d4f902c675b6e442f75242ddee9ed0e1c37cc30cf66cc.exe
-
Size
304KB
-
MD5
c4b6c77543692a891bf5575295ea5ff9
-
SHA1
0579ce49636b937878fe02e3db73a1b0fcde3083
-
SHA256
de4310ebfe29b453df0d4f902c675b6e442f75242ddee9ed0e1c37cc30cf66cc
-
SHA512
a273acf81db3fe3aff7e4a33adb1cd0ab62ff10eaff673bdd64210a9e30de26b9cb6bf31cf747eb8149818739ad1c0b37e3eac30a41f6d668c2aca17fee08d2e
-
SSDEEP
6144:YrAO+jLcHal6CQwyVmwAKWn15hMeCXO8YAajTFU+Vhz:YhKc01QwyVmwQn15yOdXG
Malware Config
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\de4310ebfe29b453df0d4f902c675b6e442f75242ddee9ed0e1c37cc30cf66cc.exe"C:\Users\Admin\AppData\Local\Temp\de4310ebfe29b453df0d4f902c675b6e442f75242ddee9ed0e1c37cc30cf66cc.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1DF.exeC:\Users\Admin\AppData\Local\Temp\1DF.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Pedeuesu.dll,start C:\Users\Admin\AppData\Local\Temp\1DF.exe2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5c335ad9a447bc1479ccf5d0f955775e0
SHA11f856b9a95e91ceb9035e31b1bb2808d9c99744d
SHA256b4451017413576547622f566432cd316b3ffce335a378869bffc1bf661005946
SHA512f6073046a6db1f50b8f0a07a85cd633d00242542916cb03a713ce3f1aab25365e21d0602311af1f986d126002a9db0cdcc6953c4fbc6108cf49e0bd556c9f3c3
-
Filesize
2.5MB
MD5c335ad9a447bc1479ccf5d0f955775e0
SHA11f856b9a95e91ceb9035e31b1bb2808d9c99744d
SHA256b4451017413576547622f566432cd316b3ffce335a378869bffc1bf661005946
SHA512f6073046a6db1f50b8f0a07a85cd633d00242542916cb03a713ce3f1aab25365e21d0602311af1f986d126002a9db0cdcc6953c4fbc6108cf49e0bd556c9f3c3
-
Filesize
3.1MB
MD541601e8acf775a91524bafa545061804
SHA1084d4b6e1b281d696630450358698e77de7d5e7e
SHA2565e509614faa874c9b13d707d7bdadcd7fbd0ee5427d8f17d0cb185e932ab868d
SHA51232e82e9eea04f6939aae935723124e10a66453b70e2d45d3303dddafd7ca38f36930e26207f8da144b5e9ecac460182b96684900096810952d82ab12379b822e
-
Filesize
2.4MB
MD5965a552812af7bf019a56444abab9471
SHA1e83e59e0b09e2a38b2b1f134e7a3b7ec6d604ef4
SHA256dd602a9598bd4506c30394f9db3b6deb1acb01c627465a2839219c18cc659d53
SHA512a31ccdcc60a74d0d83da094aa6041f467e3e7484e964ecdb6a2ea9bddb42290d07dcd62631260cf25c677109316dc5ea62fa8e2e9e7bddbccef302f946a718eb
-
Filesize
3.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
3.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
1.6MB
-
Filesize
36KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.3MB
-
Filesize
1.6MB
-
Filesize
2.4MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
6.1MB
-
Filesize
2.3MB
-
Filesize
2.4MB
-
Filesize
6.1MB
-
Filesize
6.1MB