Analysis
- max time kernel
151s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
09/12/2022, 12:37
General
- Target file.exe
- Size 383KB
- Sample221209-ptf99sdb76
- SHA256 2d7248ced4e866347104d0ea9d2741f5a986b9da3812ac957c2dd57f5ea16f19
Malware Config
Extracted
-
danabot
-
embedded_hash
341D2FD1638BB267A80C7445E1909B57
-
type
loader
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 27 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 30 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 28 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1EF2.exeC:\Users\Admin\AppData\Local\Temp\1EF2.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Didddpquafu.dll,start2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 140363⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 5122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4348 -ip 43481⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
1EF2.exe
1EF2.exe
Didddpquafu.dll
Didddpquafu.dll
Didddpquafu.dll
memory/2808-133-0x00000000008C0000-0x00000000008C9000-memory.dmp
memory/2808-134-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2808-135-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2808-132-0x0000000000587000-0x000000000059D000-memory.dmp
memory/2992-201-0x0000000003EF0000-0x0000000004030000-memory.dmp
memory/2992-202-0x0000000003EF0000-0x0000000004030000-memory.dmp
memory/2992-200-0x0000000003EF0000-0x0000000004030000-memory.dmp
memory/2992-199-0x0000000003700000-0x0000000003E25000-memory.dmp
memory/2992-198-0x0000000003700000-0x0000000003E25000-memory.dmp
memory/2992-197-0x0000000003700000-0x0000000003E25000-memory.dmp
memory/2992-172-0x00000000024B0000-0x0000000002721000-memory.dmp
memory/2992-203-0x0000000003EF0000-0x0000000004030000-memory.dmp
memory/2992-205-0x0000000003EF0000-0x0000000004030000-memory.dmp
memory/2992-204-0x0000000003EF0000-0x0000000004030000-memory.dmp
memory/2992-209-0x0000000003F69000-0x0000000003F6B000-memory.dmp
memory/2992-212-0x0000000003700000-0x0000000003E25000-memory.dmp
memory/3004-152-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-184-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-157-0x0000000002710000-0x0000000002720000-memory.dmp
memory/3004-158-0x0000000002710000-0x0000000002720000-memory.dmp
memory/3004-136-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-155-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-154-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-162-0x0000000002710000-0x0000000002720000-memory.dmp
memory/3004-163-0x0000000002710000-0x0000000002720000-memory.dmp
memory/3004-164-0x0000000002710000-0x0000000002720000-memory.dmp
memory/3004-137-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-138-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-139-0x00000000026F0000-0x0000000002700000-memory.dmp
memory/3004-153-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-151-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-150-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-149-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-148-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-173-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-174-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-175-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-176-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-178-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-180-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-181-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-182-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-183-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-156-0x0000000002710000-0x0000000002720000-memory.dmp
memory/3004-188-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-191-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-192-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-190-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-189-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-187-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-186-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-185-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-193-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-194-0x0000000004040000-0x0000000004050000-memory.dmp
memory/3004-141-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-196-0x0000000004040000-0x0000000004050000-memory.dmp
memory/3004-147-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-146-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-145-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-143-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-144-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/3004-142-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/4348-195-0x0000000000400000-0x0000000000792000-memory.dmp
memory/4348-168-0x0000000000400000-0x0000000000792000-memory.dmp
memory/4348-166-0x0000000002730000-0x0000000002AB5000-memory.dmp
memory/4348-165-0x0000000000D40000-0x0000000000F8C000-memory.dmp
memory/4904-207-0x000001CF1C530000-0x000001CF1C670000-memory.dmp
memory/4904-208-0x000001CF1C530000-0x000001CF1C670000-memory.dmp
memory/4904-210-0x0000000000830000-0x0000000000A49000-memory.dmp
memory/4904-211-0x000001CF1AB60000-0x000001CF1AD8A000-memory.dmp