Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
-
submitted
14/10/2022, 22:36
General
-
Target
97978d9ac10409390f43ea3d8ed713be20be9f750ca2195876d0f83335025812.exe
-
Size
231KB
-
MD5
fe8361fb918cbf9dbaed895c74768677
-
SHA1
a9185be6105e3e8f79720483d3bd9a3d620c43a9
-
SHA256
97978d9ac10409390f43ea3d8ed713be20be9f750ca2195876d0f83335025812
-
SHA512
4ddf74131ca828db7e0783412facd6939bb60092ca0f9273b97dce4172de92cca08ed51a76830616f7c5c78869594e43b5615e828c1285e6227e5f8ad06f264a
-
SSDEEP
3072:DXpdnvSj0YWPugr65gJVnIBh+tYsb6vRy2a0QJr5foR30KJSdEnCfkqA:7znvS0WqdIBmYrRkJrFoR30Jti
Malware Config
Extracted
danabot
-
embedded_hash
56951C922035D696BFCE443750496462
-
type
loader
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97978d9ac10409390f43ea3d8ed713be20be9f750ca2195876d0f83335025812.exe"C:\Users\Admin\AppData\Local\Temp\97978d9ac10409390f43ea3d8ed713be20be9f750ca2195876d0f83335025812.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D10.exeC:\Users\Admin\AppData\Local\Temp\D10.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD550b0e3d3354723e6dc6d843542386084
SHA15d5f99f2b0d6647c912c0d4910ef068a50e77f2f
SHA2569311cb119df791f32a940b70b154f7477cf8d017d82263798642c4a50e21950c
SHA512505e780752f455ed263e5fbd4fddd86b097b0cc5bb71f2135a65b58add8deba25af267fa7ee9f0727c3c2395e7ecf982680bbfa624d113992935f7e2c0df82a8
-
Filesize
1.3MB
MD550b0e3d3354723e6dc6d843542386084
SHA15d5f99f2b0d6647c912c0d4910ef068a50e77f2f
SHA2569311cb119df791f32a940b70b154f7477cf8d017d82263798642c4a50e21950c
SHA512505e780752f455ed263e5fbd4fddd86b097b0cc5bb71f2135a65b58add8deba25af267fa7ee9f0727c3c2395e7ecf982680bbfa624d113992935f7e2c0df82a8
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
1.6MB
-
Filesize
252KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
252KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.1MB
-
Filesize
2.8MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.8MB
-
Filesize
1.1MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB