Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
-
submitted
16/10/2022, 23:55
General
-
Target
257e71c8e07e82c77729146af5daaf4109bd1103f7b7f92c81e2e4da13c7c1ed.exe
-
Size
224KB
-
MD5
92bfa613bf98162934c2da1e48fe2de6
-
SHA1
96ffc8fd008aaa0bc82a2ffa3bfd7a1ce4e9a567
-
SHA256
257e71c8e07e82c77729146af5daaf4109bd1103f7b7f92c81e2e4da13c7c1ed
-
SHA512
d8c6814fc515d5eda3a78a1ed6a4bba21e0f35b8664bc9660f5fc698ce299a3af1c623bf4ff74e9932bbed50eeea4a743093be60027b223202fc890a0e874f81
-
SSDEEP
3072:VBXp+QH4L/nAAVLXe5Y9WU/dwwnJb2nEKGORIEn0KKPYzRj+UuS:LXH4LbLZ9oa/sn0JYNjHuS
Malware Config
Extracted
danabot
-
embedded_hash
56951C922035D696BFCE443750496462
-
type
loader
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Detects Smokeloader packer 2 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\257e71c8e07e82c77729146af5daaf4109bd1103f7b7f92c81e2e4da13c7c1ed.exe"C:\Users\Admin\AppData\Local\Temp\257e71c8e07e82c77729146af5daaf4109bd1103f7b7f92c81e2e4da13c7c1ed.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1F7E.exeC:\Users\Admin\AppData\Local\Temp\1F7E.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD57837c53afd10e26db4ef76f982476367
SHA1bcac84b0acec9d65b687779ac959fe88dafbeded
SHA2562df85ca6a0aa644f1c5f4d66f16a40123164230ef631848c8db07733214446b5
SHA512ca6f597a60105dd09bef918c4026c586c1380f9457d5a51febfa6452b2c6793b9bcbc90c3548535337e8071235025bf6a2f2361bf2e1f63182072d96302b97ec
-
Filesize
1.3MB
MD57837c53afd10e26db4ef76f982476367
SHA1bcac84b0acec9d65b687779ac959fe88dafbeded
SHA2562df85ca6a0aa644f1c5f4d66f16a40123164230ef631848c8db07733214446b5
SHA512ca6f597a60105dd09bef918c4026c586c1380f9457d5a51febfa6452b2c6793b9bcbc90c3548535337e8071235025bf6a2f2361bf2e1f63182072d96302b97ec
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
696KB
-
Filesize
1.6MB
-
Filesize
36KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
240KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
240KB
-
Filesize
36KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.2MB
-
Filesize
2.8MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.8MB
-
Filesize
1.2MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
1.6MB
-
Filesize
1.6MB