Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
16/09/2022, 14:05
General
- Target file.exe
- Size 301KB
- Sample220916-rdvh3abffn
- SHA256 ec7d6ea18f9fb861bd92b93f0d88b5d4c68dbcf5dddb638f358eac2a484996f5
Malware Config
Extracted
-
danabot
-
103.144.139.228:443
-
213.227.154.98:443
-
66.85.147.23:443
-
153.92.223.225:443
-
embedded_hash
A64A3A6ED13022027B84C77D31BE0C74
-
type
loader
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F736.exeC:\Users\Admin\AppData\Local\Temp\F736.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Etfrehti.dll,start C:\Users\Admin\AppData\Local\Temp\F736.exe2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 5362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4340 -ip 43401⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Etfrehti.dll
Etfrehti.dll
Etfrehti.dll
F736.exe
F736.exe
memory/4112-149-0x0000000002470000-0x0000000002704000-memory.dmp
memory/4112-148-0x0000000002470000-0x0000000002704000-memory.dmp
memory/4112-146-0x0000000002470000-0x0000000002704000-memory.dmp
memory/4340-141-0x0000000000400000-0x00000000005E8000-memory.dmp
memory/4340-140-0x00000000023C0000-0x000000000259C000-memory.dmp
memory/4340-139-0x00000000020CC000-0x0000000002275000-memory.dmp
memory/4340-147-0x0000000000400000-0x00000000005E8000-memory.dmp
memory/5092-132-0x0000000000809000-0x000000000081A000-memory.dmp
memory/5092-135-0x0000000000400000-0x0000000000450000-memory.dmp
memory/5092-134-0x0000000000400000-0x0000000000450000-memory.dmp
memory/5092-133-0x00000000005D0000-0x00000000005D9000-memory.dmp