Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2022, 08:17

General

  • Target

    6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578.exe

  • Size

    213KB

  • MD5

    e56b99e9aa41ef33cabc2fed9135eda7

  • SHA1

    bb48bbbdad29d3d15e5916913c4cbe93496aa2c8

  • SHA256

    6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578

  • SHA512

    aa24a8808f156e75abf1dde8dd5f1dd009581e7b41fa06d3cd5b61f99a37f2bf2a4452143cb50a2fab0e8a6fe7220a8d766529c665a0d53dcc79d010d7e8bb9b

  • SSDEEP

    3072:Z6ouiPHLy7QZwRhu/s0VRYukFi1wHTC6U8/g3xoKptpZbG3ERWR3LV:EouIHLIQquhbIFiOC6Bg3CKphqU0VB

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes
  • embedded_hash

    8F56CD73F6B5CD5D7B17B0BA61E70A82

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578.exe
    "C:\Users\Admin\AppData\Local\Temp\6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2500
  • C:\Users\Admin\AppData\Local\Temp\4074.exe
    C:\Users\Admin\AppData\Local\Temp\4074.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll,start
      2⤵
      • Loads dropped DLL
      PID:4540
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 480
      2⤵
      • Program crash
      PID:4248
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2760 -ip 2760
    1⤵
      PID:3460
    • C:\Users\Admin\AppData\Roaming\sjrdcjb
      C:\Users\Admin\AppData\Roaming\sjrdcjb
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:4228

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\4074.exe

            Filesize

            2.4MB

            MD5

            6e10b6107066da8b83187a14c8b68b23

            SHA1

            bfe5bb0d1fbd503226abf58fbd88e91e8f17ba05

            SHA256

            804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e

            SHA512

            6f4715008d918f0a940bae3970e072c39b16a6c8fb66f10bc32c4b611c93a437b3475646d0fafa3e814af6d5013a518ba5893c2c984b558f66733b4d03f83461

          • C:\Users\Admin\AppData\Local\Temp\4074.exe

            Filesize

            2.4MB

            MD5

            6e10b6107066da8b83187a14c8b68b23

            SHA1

            bfe5bb0d1fbd503226abf58fbd88e91e8f17ba05

            SHA256

            804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e

            SHA512

            6f4715008d918f0a940bae3970e072c39b16a6c8fb66f10bc32c4b611c93a437b3475646d0fafa3e814af6d5013a518ba5893c2c984b558f66733b4d03f83461

          • C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

            Filesize

            2.4MB

            MD5

            c144e146ff6b53a979bb0a7733301249

            SHA1

            6b648baf0069d293dcff7b71e59695dc1356e905

            SHA256

            13370ccf3099b560350a7c7a3e4fe1185984983ee72312d1eff181d9a0b27aed

            SHA512

            b3e35a13f2477b899961196bfd013de784edc22266598cbfe9726a343bc7998fa03c6852c5f0c5dfc35304f8eaeeb0cb11385f2e098e8179809e50335443b200

          • C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

            Filesize

            2.4MB

            MD5

            c144e146ff6b53a979bb0a7733301249

            SHA1

            6b648baf0069d293dcff7b71e59695dc1356e905

            SHA256

            13370ccf3099b560350a7c7a3e4fe1185984983ee72312d1eff181d9a0b27aed

            SHA512

            b3e35a13f2477b899961196bfd013de784edc22266598cbfe9726a343bc7998fa03c6852c5f0c5dfc35304f8eaeeb0cb11385f2e098e8179809e50335443b200

          • C:\Users\Admin\AppData\Roaming\sjrdcjb

            Filesize

            213KB

            MD5

            e56b99e9aa41ef33cabc2fed9135eda7

            SHA1

            bb48bbbdad29d3d15e5916913c4cbe93496aa2c8

            SHA256

            6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578

            SHA512

            aa24a8808f156e75abf1dde8dd5f1dd009581e7b41fa06d3cd5b61f99a37f2bf2a4452143cb50a2fab0e8a6fe7220a8d766529c665a0d53dcc79d010d7e8bb9b

          • C:\Users\Admin\AppData\Roaming\sjrdcjb

            Filesize

            213KB

            MD5

            e56b99e9aa41ef33cabc2fed9135eda7

            SHA1

            bb48bbbdad29d3d15e5916913c4cbe93496aa2c8

            SHA256

            6e94d256f51234f1bda863f499495ece3a878c0f3c47cf7c0f28023a0c76e578

            SHA512

            aa24a8808f156e75abf1dde8dd5f1dd009581e7b41fa06d3cd5b61f99a37f2bf2a4452143cb50a2fab0e8a6fe7220a8d766529c665a0d53dcc79d010d7e8bb9b

          • memory/2500-132-0x00000000006E2000-0x00000000006F2000-memory.dmp

            Filesize

            64KB

          • memory/2500-133-0x00000000001F0000-0x00000000001F9000-memory.dmp

            Filesize

            36KB

          • memory/2500-134-0x0000000000400000-0x000000000045F000-memory.dmp

            Filesize

            380KB

          • memory/2500-135-0x0000000000400000-0x000000000045F000-memory.dmp

            Filesize

            380KB

          • memory/2760-141-0x0000000000400000-0x0000000000791000-memory.dmp

            Filesize

            3.6MB

          • memory/2760-140-0x0000000002670000-0x00000000029F5000-memory.dmp

            Filesize

            3.5MB

          • memory/2760-146-0x0000000000400000-0x0000000000791000-memory.dmp

            Filesize

            3.6MB

          • memory/2760-139-0x0000000000C75000-0x0000000000EC0000-memory.dmp

            Filesize

            2.3MB

          • memory/4228-152-0x0000000000400000-0x000000000045F000-memory.dmp

            Filesize

            380KB

          • memory/4228-151-0x0000000000400000-0x000000000045F000-memory.dmp

            Filesize

            380KB

          • memory/4228-150-0x0000000000593000-0x00000000005A3000-memory.dmp

            Filesize

            64KB

          • memory/4540-147-0x0000000000400000-0x0000000000671000-memory.dmp

            Filesize

            2.4MB

          • memory/4540-145-0x0000000000400000-0x0000000000671000-memory.dmp

            Filesize

            2.4MB