danabot | ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3

Analysis

max time kernel
150s
max time network
148s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
27-10-2022 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3.exe
Size

259KB
MD5

b15f6a5eecb7b2d94fa5880f72f9f625
SHA1

1add1a0163c61d5b32969edc899e6799f78e85f8
SHA256

ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3
SHA512

b8aee7b297499910701155f7b959c6fa36eeabffefd8ef243bca0fbfde99dff653176b45337a1e4050da298e51c67dc6287ebeae38c6007d6fa84b54e6339cbd
SSDEEP

3072:SXKjOcb00D0BTKXvh45z8KxfTe+mEewEYx3Fyb34k8i7irn+6cp40Ko:SzsRuTKXv4bqE1ssiWSe0T

Score

10^/10

danabot banker trojan

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
BBBB0DB8CB7E6D152424535822E445A7
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

108A.exe

pid process

4604 108A.exe
Deletes itself 1 IoCs

Processes:

pid process

2952

pid	process
4604	108A.exe

pid	process
2952

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3.exe

pid	process
1980	ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3.exe
1980	ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3.exe
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952
2952

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2952
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3.exe

pid process

1980 ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 2952
Token: SeCreatePagefilePrivilege 2952

pid	process
2952

description	pid	process
Token: SeShutdownPrivilege	2952
Token: SeCreatePagefilePrivilege	2952

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

108A.exe

description	pid	process	target process
PID 2952 wrote to memory of 4604	2952		108A.exe
PID 2952 wrote to memory of 4604	2952		108A.exe
PID 2952 wrote to memory of 4604	2952		108A.exe
PID 4604 wrote to memory of 3984	4604	108A.exe	appidtel.exe
PID 4604 wrote to memory of 3984	4604	108A.exe	appidtel.exe
PID 4604 wrote to memory of 3984	4604	108A.exe	appidtel.exe

C:\Users\Admin\AppData\Local\Temp\ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3.exe
"C:\Users\Admin\AppData\Local\Temp\ee4a5edf71fdd7e60e4fc6bc05bcadb0ab766c9b7b514804afac9deb5ebed9c3.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1980

C:\Users\Admin\AppData\Local\Temp\108A.exe
C:\Users\Admin\AppData\Local\Temp\108A.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604

C:\Windows\SysWOW64\appidtel.exe
C:\Windows\system32\appidtel.exe
2⤵
PID:3984

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\108A.exe
Filesize
1.3MB

MD5
36b6d1674f28bc6658982d4f2212ed45

SHA1
62c4a0a1c42675e56e6b6b5e00d5d034bc31f4c0

SHA256
706c57c485b12abc4cd69773bc3bc89677e7c6c9485b5803ae1ea9af6f88c255

SHA512
e8b72e40bbfa42449eb3eacddc7000a14d0de031a5a70cca70daff621bc6e44be3c34a6375a653481aee7fe5217eb18144d1f8be513ad6d76aa3b4defec12ff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\108A.exe
Filesize
1.3MB

MD5
36b6d1674f28bc6658982d4f2212ed45

SHA1
62c4a0a1c42675e56e6b6b5e00d5d034bc31f4c0

SHA256
706c57c485b12abc4cd69773bc3bc89677e7c6c9485b5803ae1ea9af6f88c255

SHA512
e8b72e40bbfa42449eb3eacddc7000a14d0de031a5a70cca70daff621bc6e44be3c34a6375a653481aee7fe5217eb18144d1f8be513ad6d76aa3b4defec12ff8

Download Submit
memory/1980-140-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-156-0x0000000000400000-0x0000000002C2E000-memory.dmp

Filesize
40.2MB

Download
memory/1980-124-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-125-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-126-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-127-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-122-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-129-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-130-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-131-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-132-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-133-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-134-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-135-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-136-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-137-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-138-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-142-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-128-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-123-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-139-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-143-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-144-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-145-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-146-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-147-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-148-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-149-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-150-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-151-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-152-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-153-0x0000000002E63000-0x0000000002E78000-memory.dmp

Filesize
84KB

Download
memory/1980-154-0x0000000002C30000-0x0000000002D7A000-memory.dmp

Filesize
1.3MB

Download
memory/1980-155-0x0000000000400000-0x0000000002C2E000-memory.dmp

Filesize
40.2MB

Download
memory/1980-141-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-120-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/1980-121-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/3984-192-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/3984-191-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/3984-190-0x0000000000000000-mapping.dmp

Download
memory/4604-157-0x0000000000000000-mapping.dmp

Download
memory/4604-163-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-164-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-165-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-162-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-167-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-168-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-169-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-170-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-171-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-172-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-173-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-175-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-176-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-177-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-178-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-179-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-180-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-181-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-182-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-183-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-184-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-185-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-186-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-187-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-188-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-189-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-161-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-160-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-159-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4604-195-0x00000000031C0000-0x00000000032EA000-memory.dmp

Filesize
1.2MB

Download
memory/4604-196-0x0000000004B50000-0x0000000004E1C000-memory.dmp

Filesize
2.8MB

Download
memory/4604-204-0x0000000000400000-0x0000000002D3B000-memory.dmp

Filesize
41.2MB

Download
memory/4604-205-0x00000000031C0000-0x00000000032EA000-memory.dmp

Filesize
1.2MB

Download
memory/4604-206-0x0000000000400000-0x0000000002D3B000-memory.dmp

Filesize
41.2MB

Download
memory/4604-208-0x0000000000400000-0x0000000002D3B000-memory.dmp

Filesize
41.2MB

Download
memory/4604-209-0x0000000000400000-0x0000000002D3B000-memory.dmp

Filesize
41.2MB

Download