danabot | ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0

Analysis

max time kernel
150s
max time network
147s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
24-09-2022 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0.exe
Size

196KB
MD5

90be379aa0441e725bb29d92c44fd4af
SHA1

050c01ddd6adef29a4ede3ed371a8f79d0ebc469
SHA256

ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0
SHA512

6ec6e77d11d183805ddc96ceb755ce0dc273e4309acb52bb285e5a55746fd55c83ce025ad244c41b650ac3a20bcd0c0f15959c9bc4c0c42de25d468a763dd570
SSDEEP

3072:z+vTRLQdW4vb5XbBIYrU2x065w3c8H3yBTOR/Pka4x:OLl4xVNrdx0cQ3/

Score

10^/10

danabot smokeloader backdoor banker trojan

Malware Config

Extracted

Family

danabot

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

Attributes

embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2716-136-0x00000000022B0000-0x00000000022B9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

D7C7.exe

pid process

4060 D7C7.exe
Deletes itself 1 IoCs

Processes:

pid process

2028
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1992 4060 WerFault.exe D7C7.exe
1688 4060 WerFault.exe D7C7.exe

pid	process
4060	D7C7.exe

pid	process
2028

pid	pid_target	process	target process
1992	4060	WerFault.exe	D7C7.exe
1688	4060	WerFault.exe	D7C7.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0.exe

pid	process
2716	ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0.exe
2716	ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0.exe
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028
2028

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2028
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0.exe

pid process

2716 ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 2028
Token: SeCreatePagefilePrivilege 2028

pid	process
2028

description	pid	process
Token: SeShutdownPrivilege	2028
Token: SeCreatePagefilePrivilege	2028

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

D7C7.exe

description	pid	process	target process
PID 2028 wrote to memory of 4060	2028		D7C7.exe
PID 2028 wrote to memory of 4060	2028		D7C7.exe
PID 2028 wrote to memory of 4060	2028		D7C7.exe
PID 4060 wrote to memory of 2928	4060	D7C7.exe	appidtel.exe
PID 4060 wrote to memory of 2928	4060	D7C7.exe	appidtel.exe
PID 4060 wrote to memory of 2928	4060	D7C7.exe	appidtel.exe
PID 4060 wrote to memory of 4836	4060	D7C7.exe	rundll32.exe
PID 4060 wrote to memory of 4836	4060	D7C7.exe	rundll32.exe
PID 4060 wrote to memory of 4836	4060	D7C7.exe	rundll32.exe
PID 4060 wrote to memory of 4836	4060	D7C7.exe	rundll32.exe
PID 4060 wrote to memory of 4836	4060	D7C7.exe	rundll32.exe
PID 4060 wrote to memory of 4836	4060	D7C7.exe	rundll32.exe
PID 4060 wrote to memory of 4836	4060	D7C7.exe	rundll32.exe
PID 4060 wrote to memory of 4836	4060	D7C7.exe	rundll32.exe
PID 4060 wrote to memory of 4836	4060	D7C7.exe	rundll32.exe
PID 4060 wrote to memory of 4836	4060	D7C7.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0.exe
"C:\Users\Admin\AppData\Local\Temp\ee6b1ceacf3593dbe01ceaae5ccc142e550364942620b19c4eb28b2bae9c0ce0.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2716

C:\Users\Admin\AppData\Local\Temp\D7C7.exe
C:\Users\Admin\AppData\Local\Temp\D7C7.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\appidtel.exe
C:\Windows\system32\appidtel.exe
2⤵
PID:2928

C:\Windows\syswow64\rundll32.exe
"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
2⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 640
2⤵
- Program crash
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 612
2⤵
- Program crash
PID:1688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D7C7.exe
Filesize
1.3MB

MD5
ce4ad3f233333397580843b56b17eaa4

SHA1
2ec3e070183b26af6dd8afe63d0bebb9e3c8b902

SHA256
d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048

SHA512
06275470139a17f23f4bcd93b06514e71ee40e9ee44ebda5d28b6d6c94af687d29346210cc127b5bec1ec657326fea109afdb6172319393855a4ea352388fb43

Download Submit
C:\Users\Admin\AppData\Local\Temp\D7C7.exe
Filesize
1.3MB

MD5
ce4ad3f233333397580843b56b17eaa4

SHA1
2ec3e070183b26af6dd8afe63d0bebb9e3c8b902

SHA256
d6fd66880b910ec9531fd9f534c9bea659976f72be7789d5f75e923a12c69048

SHA512
06275470139a17f23f4bcd93b06514e71ee40e9ee44ebda5d28b6d6c94af687d29346210cc127b5bec1ec657326fea109afdb6172319393855a4ea352388fb43

Download Submit
memory/2716-116-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-117-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-118-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-119-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-120-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-122-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-121-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-123-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-124-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-125-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-126-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-127-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-128-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-129-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-130-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-131-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-132-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-133-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-135-0x0000000000916000-0x0000000000926000-memory.dmp

Filesize
64KB

Download
memory/2716-134-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-138-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download
memory/2716-137-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-139-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-140-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-136-0x00000000022B0000-0x00000000022B9000-memory.dmp

Filesize
36KB

Download
memory/2716-141-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-142-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-143-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-144-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-145-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-146-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-147-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-148-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-149-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-150-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-151-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2716-152-0x0000000000916000-0x0000000000926000-memory.dmp

Filesize
64KB

Download
memory/2716-153-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download
memory/2928-189-0x0000000000000000-mapping.dmp

Download
memory/2928-190-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2928-191-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-154-0x0000000000000000-mapping.dmp

Download
memory/4060-156-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-157-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-158-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-159-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-160-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-161-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-164-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-165-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-166-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-167-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-162-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-168-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-169-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-170-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-171-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-173-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-174-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-175-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-176-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-177-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-178-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-179-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-180-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-181-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-183-0x0000000002330000-0x0000000002466000-memory.dmp

Filesize
1.2MB

Download
memory/4060-182-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-184-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-186-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-185-0x0000000002470000-0x000000000274B000-memory.dmp

Filesize
2.9MB

Download
memory/4060-187-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-188-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4060-198-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/4060-202-0x0000000002330000-0x0000000002466000-memory.dmp

Filesize
1.2MB

Download
memory/4060-203-0x0000000002470000-0x000000000274B000-memory.dmp

Filesize
2.9MB

Download
memory/4060-204-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/4060-217-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/4060-218-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download