Analysis
-
max time kernel
165s -
max time network
175s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
04/10/2022, 16:46
General
-
Target
5cf8d15847cbc4f3be8686db95dc918fc01e53ce9e74cd7cc7e189d474d4e989.exe
-
Size
265KB
-
MD5
7a0c77ee41e10851af68272f00b6dbff
-
SHA1
2883acf384b50634149072b3d1aff8333ffa456d
-
SHA256
5cf8d15847cbc4f3be8686db95dc918fc01e53ce9e74cd7cc7e189d474d4e989
-
SHA512
cbe16bdafbef3a2d07438116778ba31d316166e1309e6f56763aefe5739c2a01de08c6f2b7d4206ec6d731a1439d3fb1f5fba935feb008c97a6dc69d8f95a646
-
SSDEEP
6144:ZtF93LLd1WlnWbPrfXJuCuzbgwuO1+wVf:Z5vdUJqrXBunnx
Malware Config
Extracted
danabot
-
embedded_hash
EAD30BF58E340E9E105B328F524565E0
-
type
loader
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cf8d15847cbc4f3be8686db95dc918fc01e53ce9e74cd7cc7e189d474d4e989.exe"C:\Users\Admin\AppData\Local\Temp\5cf8d15847cbc4f3be8686db95dc918fc01e53ce9e74cd7cc7e189d474d4e989.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\C35B.exeC:\Users\Admin\AppData\Local\Temp\C35B.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.6MB
MD596a464cd2b17c188539df98a59927069
SHA17ea4a621e3aece14ea53944a7656321f0cc23ba6
SHA256e4a8d0c5ce7c8b1e943c671968614dd40059bd2ccfb9112affe65f80aae1f1d8
SHA51295a25ca0919d33283dbfe082f8b236e7072c6ef1fd6efe7042fff17995b28ad68d324b0d09ac0d09e421eeac0b1c1bd6514954e2aa8925f8532bf212f7a0ab50
-
Filesize
4.6MB
MD596a464cd2b17c188539df98a59927069
SHA17ea4a621e3aece14ea53944a7656321f0cc23ba6
SHA256e4a8d0c5ce7c8b1e943c671968614dd40059bd2ccfb9112affe65f80aae1f1d8
SHA51295a25ca0919d33283dbfe082f8b236e7072c6ef1fd6efe7042fff17995b28ad68d324b0d09ac0d09e421eeac0b1c1bd6514954e2aa8925f8532bf212f7a0ab50
-
Filesize
288KB
-
Filesize
696KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
288KB
-
Filesize
1.6MB
-
Filesize
696KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4.4MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
6.1MB
-
Filesize
1.6MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
4.4MB