Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
07/10/2022, 19:09
General
-
Target
3a2343fb84d6461c4c86bf4d66e6dce0eb4406e3bfbcb933d8387316b3bcc87b.exe
-
Size
268KB
-
MD5
1cc90586176dc7cdc6aabf82a8220312
-
SHA1
644e661ec63925b14c900e45a7e14809e73e0f0a
-
SHA256
3a2343fb84d6461c4c86bf4d66e6dce0eb4406e3bfbcb933d8387316b3bcc87b
-
SHA512
f8ef1ec287bb80d18d3aeceb3c90d00ea6c7e6b77caf2d2382fe437a449db01123a3155312011d109d67712e612d6ff18a1e9ba6bd0bbcc85343a26e05ad9d6b
-
SSDEEP
3072:NXNofhihbLE+NyNphMm5B6Ep+JNWYDEXAPvrJESOIB6p8Dm75/k66MzGVggjcGky:JuZkyT1Z83wQbJE2K8D28CO7ITsqe4
Malware Config
Extracted
danabot
192.236.233.188:443
192.119.70.159:443
23.106.124.171:443
213.227.155.103:443
-
embedded_hash
56951C922035D696BFCE443750496462
-
type
loader
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Deletes itself 1 IoCs
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a2343fb84d6461c4c86bf4d66e6dce0eb4406e3bfbcb933d8387316b3bcc87b.exe"C:\Users\Admin\AppData\Local\Temp\3a2343fb84d6461c4c86bf4d66e6dce0eb4406e3bfbcb933d8387316b3bcc87b.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\swsdviwC:\Users\Admin\AppData\Roaming\swsdviw1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\69E5.exeC:\Users\Admin\AppData\Local\Temp\69E5.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 6042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 6322⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5bf200441ffc51bd1165007151e962b58
SHA170d2990bfc240f2f0287f95ffd2a8cb3bdc8acee
SHA25634ab3de1d585ee28cbc734e24bc45bd9e3170a71afa32357be60e2580bf5cfee
SHA512cd22312676e938407c61b206c5898799790120fc1d3ce820955bc1a127725df8ba047333888e5111507196098fc80c9fb585b96f82cff6db707dd52bc70439fb
-
Filesize
1.3MB
MD5bf200441ffc51bd1165007151e962b58
SHA170d2990bfc240f2f0287f95ffd2a8cb3bdc8acee
SHA25634ab3de1d585ee28cbc734e24bc45bd9e3170a71afa32357be60e2580bf5cfee
SHA512cd22312676e938407c61b206c5898799790120fc1d3ce820955bc1a127725df8ba047333888e5111507196098fc80c9fb585b96f82cff6db707dd52bc70439fb
-
Filesize
268KB
MD51cc90586176dc7cdc6aabf82a8220312
SHA1644e661ec63925b14c900e45a7e14809e73e0f0a
SHA2563a2343fb84d6461c4c86bf4d66e6dce0eb4406e3bfbcb933d8387316b3bcc87b
SHA512f8ef1ec287bb80d18d3aeceb3c90d00ea6c7e6b77caf2d2382fe437a449db01123a3155312011d109d67712e612d6ff18a1e9ba6bd0bbcc85343a26e05ad9d6b
-
Filesize
268KB
MD51cc90586176dc7cdc6aabf82a8220312
SHA1644e661ec63925b14c900e45a7e14809e73e0f0a
SHA2563a2343fb84d6461c4c86bf4d66e6dce0eb4406e3bfbcb933d8387316b3bcc87b
SHA512f8ef1ec287bb80d18d3aeceb3c90d00ea6c7e6b77caf2d2382fe437a449db01123a3155312011d109d67712e612d6ff18a1e9ba6bd0bbcc85343a26e05ad9d6b
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
68KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
696KB
-
Filesize
1.6MB
-
Filesize
288KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
288KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
1.2MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
1.2MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
68KB
-
Filesize
696KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB