Analysis
-
max time kernel
306s -
max time network
319s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
04/10/2022, 06:13
General
-
Target
9ee17179fc36fbc73d255264aff87becb1b041e1debcd0a8ed584984642dbb67.exe
-
Size
1.9MB
-
MD5
43ea96e5e940e855f73c5c6b9ffabb2d
-
SHA1
677d621678417dcc4abf832686f0c8f1c5a00fc1
-
SHA256
9ee17179fc36fbc73d255264aff87becb1b041e1debcd0a8ed584984642dbb67
-
SHA512
cc7d3a1a1cd826e2f7459e24dd3bb25794c906527114118fba370a1243eb1527c5b163a04a80645d13844b42d19ffb9a364ffc6a5e8233a1b0efd4e82af79b75
-
SSDEEP
49152:Q5VJWv/QA9dvKpEQ2zJFu+Vp9LLvYcKzdtncU/FILb7:Q5XWvYAmIJFbdQlpu/
Malware Config
Extracted
danabot
23.254.226.20:443
198.15.112.179:443
66.85.147.23:443
-
embedded_hash
8AA34A6CD5B6C9D509DB2C72E1AE6D88
-
type
loader
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ee17179fc36fbc73d255264aff87becb1b041e1debcd0a8ed584984642dbb67.exe"C:\Users\Admin\AppData\Local\Temp\9ee17179fc36fbc73d255264aff87becb1b041e1debcd0a8ed584984642dbb67.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll,start C:\Users\Admin\AppData\Local\Temp\9EE171~1.EXE2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD503528423ab726a2474cbfb386d14817e
SHA15e973a84f864e0f0313f11c7f381faf443c42017
SHA256b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1
SHA512866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4
-
Filesize
2.6MB
MD503528423ab726a2474cbfb386d14817e
SHA15e973a84f864e0f0313f11c7f381faf443c42017
SHA256b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1
SHA512866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
41.2MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
41.2MB
-
Filesize
41.2MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.7MB
-
Filesize
2.7MB