Overview

overview

10

Static

static

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    1005KB

  • Sample

    221218-1q9cesgg5s

  • MD5

    52a4ac130352fd65ad0f411799d74abe

  • SHA1

    bb2d4993fc3cf1b110e81a68a26c606f71c10c3e

  • SHA256

    1880b1a25e05835f30fb291b7871e594a85aec146c659ee32b8ab4f950635a4f

  • SHA512

    2115c912a44b6e881558c6c593bf480882bdcddadb7401a1cea0841946f848865992287429eaf4d2950fb1f2753b903a5e58cafb9c5b7b06e909def98673bfbf

  • SSDEEP

    24576:CYzxn6MvPWzlhSOjIi4K4dWRT63gqYbXF:CMxJvSIi4ipX

Score
10/10
danabotbankercollectiondiscoverypersistencespywarestealertrojan

Malware Config

Targets

    • Target

      tmp

    • Size

      1005KB

    • MD5

      52a4ac130352fd65ad0f411799d74abe

    • SHA1

      bb2d4993fc3cf1b110e81a68a26c606f71c10c3e

    • SHA256

      1880b1a25e05835f30fb291b7871e594a85aec146c659ee32b8ab4f950635a4f

    • SHA512

      2115c912a44b6e881558c6c593bf480882bdcddadb7401a1cea0841946f848865992287429eaf4d2950fb1f2753b903a5e58cafb9c5b7b06e909def98673bfbf

    • SSDEEP

      24576:CYzxn6MvPWzlhSOjIi4K4dWRT63gqYbXF:CMxJvSIi4ipX

    Score
    10/10
    danabotbankercollectiondiscoverypersistencespywarestealertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks