Analysis

  • max time kernel
    76s
  • max time network
    62s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23-09-2022 06:30

General

  • Target

    1fad233d89ace9b3cb104d99c6d73613e768ff06da482097183880c5c716433f.exe

  • Size

    1MB

  • MD5

    10b0c3dfacb99f9f2ca02f9df4bc96db

  • SHA1

    13a48798517d9b28961d49bf67f5764b46ca14b7

  • SHA256

    1fad233d89ace9b3cb104d99c6d73613e768ff06da482097183880c5c716433f

  • SHA512

    b4fc3b20a9f14c777b8d69ca65d02052a13d45a3ee42fc733bdaa299339ce9c4316534b303ce413a8f43efde7d11213067991b3f969c30fefdd884f571e0cb9f

Score
10/10

Malware Config

Extracted

Family

danabot

C2

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

Attributes
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Program crash ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fad233d89ace9b3cb104d99c6d73613e768ff06da482097183880c5c716433f.exe
    "C:\Users\Admin\AppData\Local\Temp\1fad233d89ace9b3cb104d99c6d73613e768ff06da482097183880c5c716433f.exe"
    Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\SysWOW64\appidtel.exe
      C:\Windows\system32\appidtel.exe
      PID:2772
    • C:\Windows\syswow64\rundll32.exe
      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
      PID:4480
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 628
      Program crash
      PID:3340
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 604
      Program crash
      PID:3496

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/2204-151-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-127-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-122-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-123-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-124-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-125-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-126-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-120-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-128-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-129-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-130-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-132-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-131-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-133-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-134-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-136-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-137-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-138-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-139-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-140-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-141-0x00000000025F0000-0x0000000002721000-memory.dmp
                          • memory/2204-142-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-144-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-143-0x0000000002730000-0x0000000002A0B000-memory.dmp
                          • memory/2204-145-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-146-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-147-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-148-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-149-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-150-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-165-0x00000000025F0000-0x0000000002721000-memory.dmp
                          • memory/2204-160-0x0000000000400000-0x00000000006E8000-memory.dmp
                          • memory/2204-121-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-166-0x0000000002730000-0x0000000002A0B000-memory.dmp
                          • memory/2204-167-0x0000000000400000-0x00000000006E8000-memory.dmp
                          • memory/2204-168-0x0000000000400000-0x00000000006E8000-memory.dmp
                          • memory/2204-181-0x0000000000400000-0x00000000006E8000-memory.dmp
                          • memory/2204-180-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-179-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-178-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-177-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-176-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-175-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-169-0x0000000000400000-0x00000000006E8000-memory.dmp
                          • memory/2204-170-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-171-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-172-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-173-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2204-174-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2772-158-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2772-157-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2772-156-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2772-155-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2772-154-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2772-153-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2772-152-0x0000000000000000-mapping.dmp
                          • memory/2772-159-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2772-161-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2772-163-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2772-162-0x0000000077540000-0x00000000776CE000-memory.dmp
                          • memory/2772-164-0x0000000077540000-0x00000000776CE000-memory.dmp