danabot | 554f8178fde6f28d1b4d924bf3d5a1385265be6c45cd3b54ed000c6d04ed2940

General

Target

file.exe
Size

214KB
MD5

9e19a1bbe97ae7591504a361a540c2e7
SHA1

4006adb77aa693e9739909ddbd7d7ad082c935e7
SHA256

554f8178fde6f28d1b4d924bf3d5a1385265be6c45cd3b54ed000c6d04ed2940
SHA512

a526897f9a98abf1d2c9c40ba45a801577452f9c918fd463e840adbf502bff9ca33e7766fc6a233571ae897cd3686bd7303b6a06fda7cb3364f5ed992dde4c3d
SSDEEP

3072:IfOs2LR24RefSQ9o6EgkNOaXFQ5Zthoq2I1g3uRlbTwHOil3lk025PH:m+Lo9B7EgAVWoSu+fwjlVklPH

Score

10^/10

danabot smokeloader backdoor banker trojan

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes

embedded_hash
8F56CD73F6B5CD5D7B17B0BA61E70A82
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1764-133-0x00000000001F0000-0x00000000001F9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

51 4348 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

FDDD.exehfgcfui

pid process

4736 FDDD.exe
4632 hfgcfui
Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

4348 rundll32.exe
4348 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1828 4736 WerFault.exe FDDD.exe

flow	pid	process
51	4348	rundll32.exe

pid	process
4736	FDDD.exe
4632	hfgcfui

pid	process
4348	rundll32.exe
4348	rundll32.exe

pid	pid_target	process	target process
1828	4736	WerFault.exe	FDDD.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

hfgcfuifile.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hfgcfui
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hfgcfui
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hfgcfui

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exe

pid	process
1764	file.exe
1764	file.exe
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792
792

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

792
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

file.exehfgcfui

pid process

1764 file.exe
4632 hfgcfui

pid	process
792

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	792
Token: SeCreatePagefilePrivilege	792
Token: SeShutdownPrivilege	792
Token: SeCreatePagefilePrivilege	792

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

FDDD.exe

description	pid	process	target process
PID 792 wrote to memory of 4736	792		FDDD.exe
PID 792 wrote to memory of 4736	792		FDDD.exe
PID 792 wrote to memory of 4736	792		FDDD.exe
PID 4736 wrote to memory of 4348	4736	FDDD.exe	rundll32.exe
PID 4736 wrote to memory of 4348	4736	FDDD.exe	rundll32.exe
PID 4736 wrote to memory of 4348	4736	FDDD.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1764

C:\Users\Admin\AppData\Local\Temp\FDDD.exe
C:\Users\Admin\AppData\Local\Temp\FDDD.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll,start
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 480
2⤵
- Program crash
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4736 -ip 4736
1⤵
PID:2120

C:\Users\Admin\AppData\Roaming\hfgcfui
C:\Users\Admin\AppData\Roaming\hfgcfui
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FDDD.exe
Filesize
2.4MB

MD5
73d6902d621eaf39531d4115dd5ec524

SHA1
e9a1c23b79add277750b5063e67544f599cdbe54

SHA256
ca8d37d3714da79fd3a4819840061dc744315738abb6767768ba6adb93f3bc25

SHA512
b66ba42c23bc0e125b2dc341984ab3def9e639a4aa250eadf56bf6e4b4b85861f925e992905f9162f19e5e27b046f4d36464fe11b3bda3473b1a7cae7b9dca07

Download Submit
C:\Users\Admin\AppData\Local\Temp\FDDD.exe
Filesize
2.4MB

MD5
73d6902d621eaf39531d4115dd5ec524

SHA1
e9a1c23b79add277750b5063e67544f599cdbe54

SHA256
ca8d37d3714da79fd3a4819840061dc744315738abb6767768ba6adb93f3bc25

SHA512
b66ba42c23bc0e125b2dc341984ab3def9e639a4aa250eadf56bf6e4b4b85861f925e992905f9162f19e5e27b046f4d36464fe11b3bda3473b1a7cae7b9dca07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
Filesize
2.4MB

MD5
279bc43461083c34d398cd027e51e0ae

SHA1
a378558520cb6ba97aeeb726ab1919085ca83ec5

SHA256
296d17d7e249c9b71948e948ccb81763dc02b0e8eff9f4a05cc7481db65b95c5

SHA512
487c9ca61d78abdbdb4ba9a2dbc18725a692b51639e846ddd892b77eb0b00d6de33d9a5c8ace46e8ba69698ad791c40eb6482695e0c6c2848f9d89322afcfbb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
Filesize
2.4MB

MD5
279bc43461083c34d398cd027e51e0ae

SHA1
a378558520cb6ba97aeeb726ab1919085ca83ec5

SHA256
296d17d7e249c9b71948e948ccb81763dc02b0e8eff9f4a05cc7481db65b95c5

SHA512
487c9ca61d78abdbdb4ba9a2dbc18725a692b51639e846ddd892b77eb0b00d6de33d9a5c8ace46e8ba69698ad791c40eb6482695e0c6c2848f9d89322afcfbb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll
Filesize
2.4MB

MD5
279bc43461083c34d398cd027e51e0ae

SHA1
a378558520cb6ba97aeeb726ab1919085ca83ec5

SHA256
296d17d7e249c9b71948e948ccb81763dc02b0e8eff9f4a05cc7481db65b95c5

SHA512
487c9ca61d78abdbdb4ba9a2dbc18725a692b51639e846ddd892b77eb0b00d6de33d9a5c8ace46e8ba69698ad791c40eb6482695e0c6c2848f9d89322afcfbb6

Download Submit
C:\Users\Admin\AppData\Roaming\hfgcfui
Filesize
214KB

MD5
9e19a1bbe97ae7591504a361a540c2e7

SHA1
4006adb77aa693e9739909ddbd7d7ad082c935e7

SHA256
554f8178fde6f28d1b4d924bf3d5a1385265be6c45cd3b54ed000c6d04ed2940

SHA512
a526897f9a98abf1d2c9c40ba45a801577452f9c918fd463e840adbf502bff9ca33e7766fc6a233571ae897cd3686bd7303b6a06fda7cb3364f5ed992dde4c3d

Download Submit
C:\Users\Admin\AppData\Roaming\hfgcfui
Filesize
214KB

MD5
9e19a1bbe97ae7591504a361a540c2e7

SHA1
4006adb77aa693e9739909ddbd7d7ad082c935e7

SHA256
554f8178fde6f28d1b4d924bf3d5a1385265be6c45cd3b54ed000c6d04ed2940

SHA512
a526897f9a98abf1d2c9c40ba45a801577452f9c918fd463e840adbf502bff9ca33e7766fc6a233571ae897cd3686bd7303b6a06fda7cb3364f5ed992dde4c3d

Download Submit
memory/1764-133-0x00000000001F0000-0x00000000001F9000-memory.dmp

Filesize
36KB

Download
memory/1764-132-0x0000000000623000-0x0000000000634000-memory.dmp

Filesize
68KB

Download
memory/1764-135-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1764-134-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4348-148-0x0000000002020000-0x0000000002291000-memory.dmp

Filesize
2.4MB

Download
memory/4348-145-0x0000000002020000-0x0000000002291000-memory.dmp

Filesize
2.4MB

Download
memory/4348-147-0x0000000002020000-0x0000000002291000-memory.dmp

Filesize
2.4MB

Download
memory/4348-141-0x0000000000000000-mapping.dmp

Download
memory/4348-154-0x0000000002A50000-0x0000000003175000-memory.dmp

Filesize
7.1MB

Download
memory/4348-155-0x0000000002A50000-0x0000000003175000-memory.dmp

Filesize
7.1MB

Download
memory/4632-151-0x0000000000583000-0x0000000000594000-memory.dmp

Filesize
68KB

Download
memory/4632-152-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4632-153-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4736-136-0x0000000000000000-mapping.dmp

Download
memory/4736-146-0x0000000000400000-0x0000000000791000-memory.dmp

Filesize
3.6MB

Download
memory/4736-140-0x0000000002620000-0x00000000029A5000-memory.dmp

Filesize
3.5MB

Download
memory/4736-139-0x00000000009F1000-0x0000000000C3C000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads