Analysis
-
max time kernel
152s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
-
submitted
14-10-2022 13:33
General
-
Target
a313ba86e10a0740312fe203d5ae61fd6000b6639dc4c976d62050fe81aa3962.exe
-
Size
232KB
-
MD5
78484b4b3be56f7d6ec26219a7b262b7
-
SHA1
5d5c43764824f120e2770bf3e483d360e8fe6c83
-
SHA256
a313ba86e10a0740312fe203d5ae61fd6000b6639dc4c976d62050fe81aa3962
-
SHA512
a48f548d612de3b620b181f65d89074469e864e3591956e2163309f343f0371626bee3eb4f7df840caa9eb94eed29697eb45b8de4c6a5638a551708e3e91a145
-
SSDEEP
3072:YXN+ENpaLx86Rx1s57bmGqCLdzchI9Etx9eii0K6RzgORP2RITih:s1papL1ubmG2tx9Di0lZgORPsITih
Malware Config
Extracted
danabot
-
embedded_hash
56951C922035D696BFCE443750496462
-
type
loader
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a313ba86e10a0740312fe203d5ae61fd6000b6639dc4c976d62050fe81aa3962.exe"C:\Users\Admin\AppData\Local\Temp\a313ba86e10a0740312fe203d5ae61fd6000b6639dc4c976d62050fe81aa3962.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\6467.exeC:\Users\Admin\AppData\Local\Temp\6467.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD503046560856663d2f9ddc4a48f976f03
SHA1399a60dd4b2456fd4dbce8acf0f49841256fdd25
SHA256dd19087cd85b24b84525e1082be97a154a2aacff498b86c2f461cd7e92a8b148
SHA512a3e631ff11813cd7ce3116b3730e18f9d4afb3b06db796ee5b78f1bd37d292e0db8ca1245333adc49fbca47f1f8b955ca10b735d5c90e797634090d1bee28446
-
Filesize
1.3MB
MD503046560856663d2f9ddc4a48f976f03
SHA1399a60dd4b2456fd4dbce8acf0f49841256fdd25
SHA256dd19087cd85b24b84525e1082be97a154a2aacff498b86c2f461cd7e92a8b148
SHA512a3e631ff11813cd7ce3116b3730e18f9d4afb3b06db796ee5b78f1bd37d292e0db8ca1245333adc49fbca47f1f8b955ca10b735d5c90e797634090d1bee28446
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
252KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
36KB
-
Filesize
696KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
252KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.2MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
1.2MB
-
Filesize
2.8MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.8MB
-
Filesize
2.8MB