Analysis
- max time kernel
178s - max time network
190s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
12/10/2022, 00:02
General
- Target file.exe
- Size 274KB
- Sample221012-abftfscacp
- SHA256 5836ed313cfd6d3a7cb7c9bf1bd5f8a0d19ff815f66f8a8ab3427319d94db086
Malware Config
Extracted
-
danabot
-
embedded_hash
56951C922035D696BFCE443750496462
-
type
loader
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Detects Smokeloader packer 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\C7EF.exeC:\Users\Admin\AppData\Local\Temp\C7EF.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
C7EF.exe
C7EF.exe
memory/1848-147-0x0000000000400000-0x00000000006CE000-memory.dmp
memory/1848-146-0x0000000002640000-0x0000000002902000-memory.dmp
memory/1848-145-0x0000000000400000-0x00000000006CE000-memory.dmp
memory/1848-143-0x0000000002640000-0x0000000002902000-memory.dmp
memory/1848-142-0x0000000002415000-0x0000000002533000-memory.dmp
memory/3380-136-0x000000000050E000-0x000000000051F000-memory.dmp
memory/3380-138-0x0000000000400000-0x000000000044A000-memory.dmp
memory/3380-137-0x00000000004C0000-0x00000000004C9000-memory.dmp
memory/3380-132-0x000000000050E000-0x000000000051F000-memory.dmp
memory/3380-135-0x0000000000400000-0x000000000044A000-memory.dmp
memory/3380-134-0x000000000050E000-0x000000000051F000-memory.dmp
memory/3380-133-0x00000000004C0000-0x00000000004C9000-memory.dmp