Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
-
submitted
09-10-2022 18:20
General
-
Target
5d862c236bceec83922b1179e7b38ad89dc29d55b478d031e17c1d5a01f55874.exe
-
Size
269KB
-
MD5
afa77851dfa878fa82de8dfd4184be3f
-
SHA1
17fae8932cf8c98512c5895b2628820dd5e21395
-
SHA256
5d862c236bceec83922b1179e7b38ad89dc29d55b478d031e17c1d5a01f55874
-
SHA512
7b8c14c10585fd66e7bd174906cdfff5581b548e2df9832fcf60863e33083fbb971b844830f1c5155bff70dd10a4063c16bb79eea5cfbb097b34b41d184f58db
-
SSDEEP
3072:+jXJH+hH7+5Pc6vFv5sb1sCVdHNMTj4lb/JP31HOMmBM/h3qpZa9uD6VdyhkhUux:+bRY76FmRsCVdHNQj4rJ4MmBrwVfquS
Malware Config
Extracted
danabot
-
embedded_hash
56951C922035D696BFCE443750496462
-
type
loader
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d862c236bceec83922b1179e7b38ad89dc29d55b478d031e17c1d5a01f55874.exe"C:\Users\Admin\AppData\Local\Temp\5d862c236bceec83922b1179e7b38ad89dc29d55b478d031e17c1d5a01f55874.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2F0F.exeC:\Users\Admin\AppData\Local\Temp\2F0F.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD537fd0e3db49a2d9e870a2db891467670
SHA1704397d4906d5835bc9d0d0bfada4f609ebbde17
SHA2563a792be363e901365583a6b68b8f13c8ea2c67a70a086bba2e9a383f887b1e28
SHA512bdce3ff1b3778a838ec926c00d092b1b7020ed6964b2df8d30e2e761264f858385caf0f5ecbb92ae921b18a4abe6610ad30f3ac39bf2810f17035d45665d090d
-
Filesize
1.3MB
MD537fd0e3db49a2d9e870a2db891467670
SHA1704397d4906d5835bc9d0d0bfada4f609ebbde17
SHA2563a792be363e901365583a6b68b8f13c8ea2c67a70a086bba2e9a383f887b1e28
SHA512bdce3ff1b3778a838ec926c00d092b1b7020ed6964b2df8d30e2e761264f858385caf0f5ecbb92ae921b18a4abe6610ad30f3ac39bf2810f17035d45665d090d
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
64KB
-
Filesize
1.6MB
-
Filesize
36KB
-
Filesize
1.6MB
-
Filesize
284KB
-
Filesize
64KB
-
Filesize
284KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.8MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.2MB
-
Filesize
2.8MB
-
Filesize
1.2MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB