Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2022, 05:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    317KB

  • MD5

    b269b15199b8d0670877419c9e804211

  • SHA1

    aca68aaaa3232feb0f7de714d8bb18e22230974b

  • SHA256

    070ea70d8dcebd3f601ffc189a2911e95bcff087e4b8ef96f5ce5636885408df

  • SHA512

    8889810e65ebeff6d2d0f65b0fe966fe34fc40faa29ca81a09372b14af4f535f5c5a12bc6524ccfb2ee93ae990fe3fe0229fbac3065aa402c63ec91b8f4464e8

  • SSDEEP

    6144:4zm3OC0me5g4BKxwJUapE801VlnigabwVf:4z4Oeq0C7u1Vli

Score
10/10
danabotsmokeloaderbackdoorbankertrojan

Malware Config

Extracted

Family

danabot

Attributes
  • embedded_hash

    6618C163D57D6441FCCA65D86C4D380D

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 39 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:384
  • C:\Users\Admin\AppData\Local\Temp\7105.exe
    C:\Users\Admin\AppData\Local\Temp\7105.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:240
    • C:\Windows\SysWOW64\agentactivationruntimestarter.exe
      C:\Windows\system32\agentactivationruntimestarter.exe
      2⤵
        PID:4020
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3832
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x150 0x4a0
      1⤵
        PID:3580

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\7105.exe
              Filesize

              1.4MB

              MD5

              3b239c35dd557ecd78d26f50fc394f4e

              SHA1

              337366d3cfa72c30c2c7e573c335a1f30e2fbe4d

              SHA256

              3e6995ef5e1fd163d69a6a710cef0e153fe09894ba6e7ab00b8c381964e8345b

              SHA512

              cd6275695c08641328718475a4a7d4e7ee747b34149b9c3f20da94f445938661f0e9f9cb7b680a5a72609a60e36e1828646ba54b857df9686811bd56cad7f1a5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7105.exe
              Filesize

              1.4MB

              MD5

              3b239c35dd557ecd78d26f50fc394f4e

              SHA1

              337366d3cfa72c30c2c7e573c335a1f30e2fbe4d

              SHA256

              3e6995ef5e1fd163d69a6a710cef0e153fe09894ba6e7ab00b8c381964e8345b

              SHA512

              cd6275695c08641328718475a4a7d4e7ee747b34149b9c3f20da94f445938661f0e9f9cb7b680a5a72609a60e36e1828646ba54b857df9686811bd56cad7f1a5

              Download Submit

            • memory/240-140-0x000000000245B000-0x0000000002581000-memory.dmp

              Filesize

              1.1MB

              Download

            • memory/240-141-0x0000000002610000-0x00000000028EB000-memory.dmp

              Filesize

              2.9MB

              Download

            • memory/240-142-0x0000000000400000-0x00000000006E8000-memory.dmp

              Filesize

              2.9MB

              Download

            • memory/240-143-0x0000000000400000-0x00000000006E8000-memory.dmp

              Filesize

              2.9MB

              Download

            • memory/384-132-0x00000000005EF000-0x0000000000600000-memory.dmp

              Filesize

              68KB

              Download

            • memory/384-133-0x00000000005B0000-0x00000000005B9000-memory.dmp

              Filesize

              36KB

              Download

            • memory/384-134-0x0000000000400000-0x0000000000454000-memory.dmp

              Filesize

              336KB

              Download

            • memory/384-135-0x0000000000400000-0x0000000000454000-memory.dmp

              Filesize

              336KB

              Download