danabot | 6517235ae083a10475336ec757aa38100a525b56e45f1cf305c6ed36523d74a3 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-1703-x64

Sharing

General

Target

6517235ae083a10475336ec757aa38100a525b56e45f1cf305c6ed36523d74a3
Size

1006KB
Sample

221218-25tqysgh4x
MD5

09ab2a3073c44472b97fc3ec002ea7c2
SHA1

29b4b86b5eeb1358ace14fc65d675fa6949bf71d
SHA256

6517235ae083a10475336ec757aa38100a525b56e45f1cf305c6ed36523d74a3
SHA512

fec42d8c395c55bae94fb9147b47adc4794c938df01f43058595a4513b0a3885f20f01e6b3ab354de86b81c32c2a55388d7fb70fec6abada440ef969683e2f60
SSDEEP

24576:J2IB3hDMDd/lDA25k052TG1Ni9PWiLp5MYbXF:JtB3hDcZlDhfQG1EJTLX

Score

10^/10

danabot banker collection discovery persistence spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

6517235ae083a10475336ec757aa38100a525b56e45f1cf305c6ed36523d74a3.exe

Resource

win10-20220812-en

danabot banker collection discovery persistence spyware stealer trojan

windows10-1703-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  6517235ae083a10475336ec757aa38100a525b56e45f1cf305c6ed36523d74a3
- Size
  
  1006KB
- MD5
  
  09ab2a3073c44472b97fc3ec002ea7c2
- SHA1
  
  29b4b86b5eeb1358ace14fc65d675fa6949bf71d
- SHA256
  
  6517235ae083a10475336ec757aa38100a525b56e45f1cf305c6ed36523d74a3
- SHA512
  
  fec42d8c395c55bae94fb9147b47adc4794c938df01f43058595a4513b0a3885f20f01e6b3ab354de86b81c32c2a55388d7fb70fec6abada440ef969683e2f60
- SSDEEP
  
  24576:J2IB3hDMDd/lDA25k052TG1Ni9PWiLp5MYbXF:JtB3hDcZlDhfQG1EJTLX
Score

10^/10

danabot banker collection discovery persistence spyware stealer trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Blocklisted process makes network request
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

danabotbankercollectiondiscoverypersistencespywarestealertrojan

© 2018-2024

Terms | Privacy