Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
-
submitted
24-09-2022 16:37
General
-
Target
ac2ff361585625b8f1988e20ef00acf25d40f5b43c6025018bb8c2b96fd8b049.exe
-
Size
196KB
-
MD5
7be05ae221e8cff71446c75ce04a0bed
-
SHA1
aa2ff15284e855cc5d123bedd82cef78c3b4a115
-
SHA256
ac2ff361585625b8f1988e20ef00acf25d40f5b43c6025018bb8c2b96fd8b049
-
SHA512
82d5a4d9e434bd6944387b768064713ce964dfa6822c7d575fdedda8a0832f7e9be7b7f01b752a44365526e07281a8048e7a3dc0c05aa593dfc7db33f20abe07
-
SSDEEP
3072:R0pP9L3M0xaA5TgUSQYsUKvTEmriIzBWrAFG7BZVlCc/Pkk4x:uLPxVh5TzriIzBWrAx
Malware Config
Extracted
danabot
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac2ff361585625b8f1988e20ef00acf25d40f5b43c6025018bb8c2b96fd8b049.exe"C:\Users\Admin\AppData\Local\Temp\ac2ff361585625b8f1988e20ef00acf25d40f5b43c6025018bb8c2b96fd8b049.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2FCA.exeC:\Users\Admin\AppData\Local\Temp\2FCA.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD538ba7056d233e336378d7d0f9228c9c4
SHA18ef3721c27c92928292af285b0e3f9a36e70668b
SHA25628e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb
SHA5122d95800224280634ccee934d91bdb2d307e39c794b10151b1caa8712f0c1cac12741d34e17fe8d2abf3706f0250e29b1f5f299cd59d3e64cb927ae534fffb508
-
Filesize
1.3MB
MD538ba7056d233e336378d7d0f9228c9c4
SHA18ef3721c27c92928292af285b0e3f9a36e70668b
SHA25628e21a0685da31189bde48b5ff8bd76ebcfaf78ae924d8c6991e3efa8a884deb
SHA5122d95800224280634ccee934d91bdb2d307e39c794b10151b1caa8712f0c1cac12741d34e17fe8d2abf3706f0250e29b1f5f299cd59d3e64cb927ae534fffb508
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.5MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.5MB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.9MB
-
-
Filesize
1.6MB
-
Filesize
1.2MB
-
Filesize
1.6MB
-
Filesize
1.2MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.9MB
-
Filesize
1.6MB
-