Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
16/09/2022, 16:35
General
-
Target
037e1a172f2c4044729a7a73e82bcb6193b132e00df5b665efcc55d192a88d57.exe
-
Size
301KB
-
MD5
aff64082fe89b274f9d05e28670ec4f1
-
SHA1
2bda6f8594e7e2d30c0c8c11bcf5a64ece090035
-
SHA256
037e1a172f2c4044729a7a73e82bcb6193b132e00df5b665efcc55d192a88d57
-
SHA512
baae6667e6b46eb44bba1f8fd1be272a13cfcf9a9f89a05be684f3b2001f46d61a7a14eb6bfbd16b7db9310da4e86c657714a04dadb3479c812f5ebbe19ca955
-
SSDEEP
3072:zZXj4PzoC5J07h4LkOC2RyRZI0JXqzLoYCIjkL6Rn0KbbGWpWIM/h3BsxkgaBCho:hjSkF4Lk5XiLfNo6Rn0GbWInigabwVf
Malware Config
Extracted
danabot
103.144.139.228:443
213.227.154.98:443
66.85.147.23:443
153.92.223.225:443
-
embedded_hash
A64A3A6ED13022027B84C77D31BE0C74
-
type
loader
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\037e1a172f2c4044729a7a73e82bcb6193b132e00df5b665efcc55d192a88d57.exe"C:\Users\Admin\AppData\Local\Temp\037e1a172f2c4044729a7a73e82bcb6193b132e00df5b665efcc55d192a88d57.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3103.exeC:\Users\Admin\AppData\Local\Temp\3103.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Etfrehti.dll,start C:\Users\Admin\AppData\Local\Temp\3103.exe2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5218cdec2e264fe3cc55efa80a8aca390
SHA16424ccac16a8d8d0c8ca5e82e694760618123591
SHA256bba1d412bbc0047851df401b5931da7f9e40c19f98ee8a48d467ceb7cbeb8844
SHA512665e03f2277d4653d6b9977a5ace8b0e414ce7512246dec320c22f9d5646acf02d3e3078866f110f4daa50543aaecbcd5c9cbddaa0b9973a452c0ea5ede8408f
-
Filesize
1.9MB
MD5218cdec2e264fe3cc55efa80a8aca390
SHA16424ccac16a8d8d0c8ca5e82e694760618123591
SHA256bba1d412bbc0047851df401b5931da7f9e40c19f98ee8a48d467ceb7cbeb8844
SHA512665e03f2277d4653d6b9977a5ace8b0e414ce7512246dec320c22f9d5646acf02d3e3078866f110f4daa50543aaecbcd5c9cbddaa0b9973a452c0ea5ede8408f
-
Filesize
2.5MB
MD5d7a66ca4622307cefbaf2d548edf21c1
SHA1d6e7396cf81fddc86bd9a6adb17dbec09fbd532d
SHA256c692330b06a1c232eafe7e68f867c6f339ca9545834010b0997e19f936ad0b5d
SHA5124d9e5fa064ea98af43d5fef363a69a593fdd0ae5f4b79db0794bd5b12e9ffd0c52bb53b7c7b08141f4a33ea7b786f2164504af3295ee9466477270e69b87f41c
-
Filesize
2.5MB
MD5d7a66ca4622307cefbaf2d548edf21c1
SHA1d6e7396cf81fddc86bd9a6adb17dbec09fbd532d
SHA256c692330b06a1c232eafe7e68f867c6f339ca9545834010b0997e19f936ad0b5d
SHA5124d9e5fa064ea98af43d5fef363a69a593fdd0ae5f4b79db0794bd5b12e9ffd0c52bb53b7c7b08141f4a33ea7b786f2164504af3295ee9466477270e69b87f41c
-
Filesize
2.5MB
MD5d7a66ca4622307cefbaf2d548edf21c1
SHA1d6e7396cf81fddc86bd9a6adb17dbec09fbd532d
SHA256c692330b06a1c232eafe7e68f867c6f339ca9545834010b0997e19f936ad0b5d
SHA5124d9e5fa064ea98af43d5fef363a69a593fdd0ae5f4b79db0794bd5b12e9ffd0c52bb53b7c7b08141f4a33ea7b786f2164504af3295ee9466477270e69b87f41c
-
Filesize
320KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
696KB
-
Filesize
36KB
-
Filesize
320KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.9MB
-
Filesize
1.6MB
-
Filesize
1.7MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.9MB
-
Filesize
1.9MB