Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
26/09/2022, 23:01
General
- Target file.exe
- Size 129KB
- Sample220926-2zjc2acbb6
- SHA256 adf8610d4a9a3bf3039508f2229a04e6caad4c5d50530e01fea54754cc72ba59
Malware Config
Extracted
-
danabot
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4621.exeC:\Users\Admin\AppData\Local\Temp\4621.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 6202⤵
- Program crash
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c8 0x3241⤵
-
C:\Users\Admin\AppData\Local\Temp\854E.exeC:\Users\Admin\AppData\Local\Temp\854E.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 13322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1132 -ip 11321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4392 -ip 43921⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
4621.exe
4621.exe
854E.exe
854E.exe
memory/1132-159-0x0000000006580000-0x00000000065F6000-memory.dmp
memory/1132-153-0x0000000004D60000-0x0000000004D72000-memory.dmp
memory/1132-165-0x0000000000400000-0x00000000005A5000-memory.dmp
memory/1132-164-0x0000000000919000-0x0000000000943000-memory.dmp
memory/1132-163-0x00000000069B0000-0x0000000006EDC000-memory.dmp
memory/1132-162-0x00000000067D0000-0x0000000006992000-memory.dmp
memory/1132-161-0x0000000000919000-0x0000000000943000-memory.dmp
memory/1132-160-0x0000000007480000-0x000000000749E000-memory.dmp
memory/1132-158-0x0000000006530000-0x0000000006580000-memory.dmp
memory/1132-157-0x0000000005E40000-0x0000000005EA6000-memory.dmp
memory/1132-156-0x0000000005DA0000-0x0000000005E32000-memory.dmp
memory/1132-148-0x0000000000919000-0x0000000000943000-memory.dmp
memory/1132-149-0x0000000000700000-0x0000000000737000-memory.dmp
memory/1132-150-0x0000000000400000-0x00000000005A5000-memory.dmp
memory/1132-151-0x0000000004E50000-0x00000000053F4000-memory.dmp
memory/1132-152-0x0000000005400000-0x0000000005A18000-memory.dmp
memory/1132-155-0x0000000004DA0000-0x0000000004DDC000-memory.dmp
memory/1132-154-0x0000000005A20000-0x0000000005B2A000-memory.dmp
memory/4392-142-0x0000000002580000-0x000000000285B000-memory.dmp
memory/4392-144-0x0000000000400000-0x00000000006E8000-memory.dmp
memory/4392-143-0x0000000000400000-0x00000000006E8000-memory.dmp
memory/4392-141-0x000000000244A000-0x0000000002570000-memory.dmp
memory/4392-166-0x0000000000400000-0x00000000006E8000-memory.dmp
memory/4392-167-0x0000000000400000-0x00000000006E8000-memory.dmp
memory/4392-168-0x0000000000400000-0x00000000006E8000-memory.dmp
memory/5036-134-0x0000000000400000-0x000000000057D000-memory.dmp
memory/5036-132-0x00000000005B9000-0x00000000005CA000-memory.dmp
memory/5036-133-0x0000000000580000-0x0000000000589000-memory.dmp
memory/5036-135-0x00000000005B9000-0x00000000005CA000-memory.dmp
memory/5036-136-0x0000000000400000-0x000000000057D000-memory.dmp