Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
25/09/2022, 23:11
General
- Target file.exe
- Size 176KB
- Sample220925-259geagdf5
- SHA256 1d93a0ed3ada10f0c36024e54df1dd9fb39aca60bde33ad4d4083a97e0ffbd0c
Malware Config
Extracted
-
danabot
-
198.15.112.179:443
-
185.62.56.245:443
-
153.92.223.225:443
-
192.119.70.159:443
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2C9E.exeC:\Users\Admin\AppData\Local\Temp\2C9E.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 6282⤵
- Program crash
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c8 0x2d41⤵
-
C:\Users\Admin\AppData\Local\Temp\9EC1.exeC:\Users\Admin\AppData\Local\Temp\9EC1.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 12962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3712 -ip 37121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4620 -ip 46201⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
2C9E.exe
2C9E.exe
9EC1.exe
9EC1.exe
memory/636-171-0x00000000006C0000-0x00000000006C3000-memory.dmp
memory/636-173-0x00000000006E0000-0x00000000006E3000-memory.dmp
memory/636-172-0x00000000006D0000-0x00000000006D3000-memory.dmp
memory/636-170-0x00000000006B0000-0x00000000006B3000-memory.dmp
memory/636-169-0x00000000006A0000-0x00000000006A3000-memory.dmp
memory/636-168-0x0000000000690000-0x0000000000693000-memory.dmp
memory/1584-135-0x0000000000400000-0x0000000000586000-memory.dmp
memory/1584-132-0x00000000005D9000-0x00000000005EA000-memory.dmp
memory/1584-134-0x0000000000400000-0x0000000000586000-memory.dmp
memory/1584-133-0x0000000000590000-0x0000000000599000-memory.dmp
memory/3712-162-0x0000000000769000-0x0000000000793000-memory.dmp
memory/3712-160-0x0000000006820000-0x0000000006D4C000-memory.dmp
memory/3712-149-0x0000000000400000-0x00000000005A5000-memory.dmp
memory/3712-150-0x0000000004B50000-0x00000000050F4000-memory.dmp
memory/3712-151-0x0000000005150000-0x0000000005768000-memory.dmp
memory/3712-152-0x0000000005800000-0x0000000005812000-memory.dmp
memory/3712-153-0x0000000005820000-0x000000000592A000-memory.dmp
memory/3712-154-0x0000000005950000-0x000000000598C000-memory.dmp
memory/3712-155-0x0000000005C60000-0x0000000005CC6000-memory.dmp
memory/3712-156-0x0000000006300000-0x0000000006392000-memory.dmp
memory/3712-157-0x0000000006500000-0x0000000006576000-memory.dmp
memory/3712-158-0x0000000006580000-0x000000000659E000-memory.dmp
memory/3712-159-0x0000000006640000-0x0000000006802000-memory.dmp
memory/3712-148-0x00000000021F0000-0x0000000002227000-memory.dmp
memory/3712-161-0x0000000007BF0000-0x0000000007C40000-memory.dmp
memory/3712-147-0x0000000000769000-0x0000000000793000-memory.dmp
memory/3712-163-0x0000000000769000-0x0000000000793000-memory.dmp
memory/3712-164-0x0000000000400000-0x00000000005A5000-memory.dmp
memory/4620-166-0x0000000000400000-0x00000000006E8000-memory.dmp
memory/4620-165-0x0000000000400000-0x00000000006E8000-memory.dmp
memory/4620-143-0x0000000000400000-0x00000000006E8000-memory.dmp
memory/4620-142-0x0000000000400000-0x00000000006E8000-memory.dmp
memory/4620-141-0x0000000002500000-0x00000000027DB000-memory.dmp
memory/4620-140-0x00000000023D7000-0x00000000024FD000-memory.dmp
memory/4620-174-0x0000000000400000-0x00000000006E8000-memory.dmp