Overview

overview

10

Static

static

9bbf54f784...83.exe

windows7-x64

10

9bbf54f784...83.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2022 13:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9bbf54f784afa24fbbcf1ddac2c3dec918cd7d089bf36e801bb844ba1759d583.exe

  • Size

    274KB

  • MD5

    eab82699d9cddc1a827d766ea509ef10

  • SHA1

    3b350d996b8926d8aae7e41f6440a4004bc32e76

  • SHA256

    9bbf54f784afa24fbbcf1ddac2c3dec918cd7d089bf36e801bb844ba1759d583

  • SHA512

    00a190676fe8111e2303ad3539971e4187b5871cd9b7637c04500381aac9d6179525ff6cb28222f4f1a30ad5be67b5b5fc1df6629e4d03255b46f3389ed0ec89

  • SSDEEP

    6144:tFUl7+DLH8DnKeC+Nv3hovaBLp0FT/igavwVf:tFUl7qT8DLFVBOM

Score
10/10
danabotsmokeloaderbackdoorbankertrojan

Malware Config

Extracted

Family

danabot

C2

172.86.120.215:443

213.227.155.103:443

103.187.26.147:443

172.86.120.138:443
Attributes
  • embedded_hash

    BBBB0DB8CB7E6D152424535822E445A7

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 39 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 48 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 19 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bbf54f784afa24fbbcf1ddac2c3dec918cd7d089bf36e801bb844ba1759d583.exe
    "C:\Users\Admin\AppData\Local\Temp\9bbf54f784afa24fbbcf1ddac2c3dec918cd7d089bf36e801bb844ba1759d583.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4000
  • C:\Users\Admin\AppData\Local\Temp\44AA.exe
    C:\Users\Admin\AppData\Local\Temp\44AA.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Windows\SysWOW64\agentactivationruntimestarter.exe
      C:\Windows\system32\agentactivationruntimestarter.exe
      2⤵
        PID:4336
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        2⤵
        • Blocklisted process makes network request
        PID:4540
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 628
        2⤵
        • Program crash
        PID:3264
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 880
        2⤵
        • Program crash
        PID:5044
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 920
        2⤵
        • Program crash
        PID:4900
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        2⤵
        • Blocklisted process makes network request
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:440
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 1012
        2⤵
        • Program crash
        PID:8
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3748
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x150 0x330
      1⤵
        PID:5104
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 548 -ip 548
        1⤵
          PID:4592
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 548 -ip 548
          1⤵
            PID:3436
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 548 -ip 548
            1⤵
              PID:1816
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 548 -ip 548
              1⤵
                PID:4724

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\44AA.exe
                Filesize

                1.3MB

                MD5

                0662035c9faf60b03f83eb6d8086b76c

                SHA1

                04e16bb4bbb16319d6d6b757feaf592e4e9aa8f3

                SHA256

                f94b60a436da7bad0997436e11fe090f0c9ce34f1014893d72d3cd0f9d7d7b4a

                SHA512

                a2824a9b8207fe1dc11c3ea4841405ab0f2a2962251ca700a02884dd2e9599b43c4f90bbbe86c9e93ce184ca96f51841e8a39b6b3a5252ee8ca721210eb0c9cf

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\44AA.exe
                Filesize

                1.3MB

                MD5

                0662035c9faf60b03f83eb6d8086b76c

                SHA1

                04e16bb4bbb16319d6d6b757feaf592e4e9aa8f3

                SHA256

                f94b60a436da7bad0997436e11fe090f0c9ce34f1014893d72d3cd0f9d7d7b4a

                SHA512

                a2824a9b8207fe1dc11c3ea4841405ab0f2a2962251ca700a02884dd2e9599b43c4f90bbbe86c9e93ce184ca96f51841e8a39b6b3a5252ee8ca721210eb0c9cf

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Dhfteep.tmp
                Filesize

                3.3MB

                MD5

                9ee66bd586450c037b6a14eed557a159

                SHA1

                6218331454c5204349b259ea260dd2161ce41371

                SHA256

                d9cf31419401bed1796f49f2daea2f9eea468c3643ab9086ba61d24e3283db0f

                SHA512

                eabdb81f278abe54088740b4139ca6d5b8cf99c014102128b9c3ebebf51b163d6ba0b06a066de1eeb33199c2a475c0ce585c102b7684ce2d086b493f842ee8a8

                Download Submit

              • memory/440-167-0x00000000029B0000-0x000000000346C000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/440-166-0x00000000029B0000-0x000000000346C000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/440-164-0x0000000000600000-0x0000000000F9C000-memory.dmp

                Filesize

                9.6MB

                Download

              • memory/440-165-0x0000000003470000-0x00000000035B0000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/440-163-0x0000000003470000-0x00000000035B0000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/440-162-0x00000000029B0000-0x000000000346C000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/440-161-0x0000000000000000-mapping.dmp

                Download

              • memory/548-150-0x00000000030F0000-0x0000000003BAC000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/548-155-0x0000000003C70000-0x0000000003DB0000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/548-144-0x0000000000400000-0x00000000006D8000-memory.dmp

                Filesize

                2.8MB

                Download

              • memory/548-145-0x0000000000400000-0x00000000006D8000-memory.dmp

                Filesize

                2.8MB

                Download

              • memory/548-146-0x0000000000400000-0x00000000006D8000-memory.dmp

                Filesize

                2.8MB

                Download

              • memory/548-168-0x00000000030F0000-0x0000000003BAC000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/548-148-0x0000000000400000-0x00000000006D8000-memory.dmp

                Filesize

                2.8MB

                Download

              • memory/548-142-0x0000000002490000-0x000000000275C000-memory.dmp

                Filesize

                2.8MB

                Download

              • memory/548-137-0x0000000000000000-mapping.dmp

                Download

              • memory/548-151-0x00000000030F0000-0x0000000003BAC000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/548-152-0x00000000030F0000-0x0000000003BAC000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/548-153-0x0000000003C70000-0x0000000003DB0000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/548-154-0x0000000003C70000-0x0000000003DB0000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/548-143-0x0000000000400000-0x00000000006D8000-memory.dmp

                Filesize

                2.8MB

                Download

              • memory/548-156-0x0000000003C70000-0x0000000003DB0000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/548-157-0x0000000003C70000-0x0000000003DB0000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/548-158-0x0000000003C70000-0x0000000003DB0000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/548-159-0x0000000003C70000-0x0000000003DB0000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/548-160-0x0000000003C70000-0x0000000003DB0000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/548-141-0x0000000002361000-0x0000000002482000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/4000-132-0x0000000000689000-0x000000000069A000-memory.dmp

                Filesize

                68KB

                Download

              • memory/4000-136-0x0000000000400000-0x0000000000449000-memory.dmp

                Filesize

                292KB

                Download

              • memory/4000-135-0x0000000000689000-0x000000000069A000-memory.dmp

                Filesize

                68KB

                Download

              • memory/4000-134-0x0000000000400000-0x0000000000449000-memory.dmp

                Filesize

                292KB

                Download

              • memory/4000-133-0x00000000005E0000-0x00000000005E9000-memory.dmp

                Filesize

                36KB

                Download

              • memory/4336-140-0x0000000000000000-mapping.dmp

                Download

              • memory/4540-147-0x0000000000000000-mapping.dmp

                Download