Malware Analysis Report

2025-05-28 14:50

Sample ID 221219-qkh8yaab4t
Target 0bb2b15ca73128dbc816ea4ed583119c.exe
SHA256 295dfd4608b81ee276a04f1c58d806b7f906695e744cfe8234eca6360c555ca8
Tags
danabot banker discovery persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

295dfd4608b81ee276a04f1c58d806b7f906695e744cfe8234eca6360c555ca8

Threat Level: Known bad

The file 0bb2b15ca73128dbc816ea4ed583119c.exe was found to be: Known bad.

Malicious Activity Summary

danabot banker discovery persistence trojan

Danabot

Blocklisted process makes network request

Sets DLL path for service in the registry

Sets service image path in registry

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-12-19 13:19

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-12-19 13:19

Reported

2022-12-19 13:21

Platform

win7-20221111-en

Max time kernel

135s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe"

Signatures

Danabot

trojan banker danabot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\DWTRIG20\Parameters\ServiceDll = "C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\DWTRIG20.dll" C:\Windows\SysWOW64\rundll32.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\DWTRIG20\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService" C:\Windows\SysWOW64\rundll32.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2008 set thread context of 1708 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\VDK10.LIC C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\SendMail.api C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\brt04.hsp C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.LIC C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\DWTRIG20.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\atl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\A3DUtility.exe C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\QRCode.pmp C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Adobe AIR Updater.exe C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\end_review.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\eula.ini C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\AcroBroker.exe C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\eqnedt32.exe.manifest C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\eqnedt32.exe.manifest C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\QRCode.pmp C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\XDPFile_8.ico C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000102054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 C:\Windows\system32\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Windows\system32\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe C:\Windows\SysWOW64\rundll32.exe
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe C:\Windows\SysWOW64\rundll32.exe
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe C:\Windows\SysWOW64\rundll32.exe
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe C:\Windows\SysWOW64\rundll32.exe
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe C:\Windows\SysWOW64\rundll32.exe
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe C:\Windows\SysWOW64\rundll32.exe
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe C:\Windows\SysWOW64\rundll32.exe
PID 2008 wrote to memory of 1708 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 2008 wrote to memory of 1708 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 2008 wrote to memory of 1708 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 2008 wrote to memory of 1708 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 2008 wrote to memory of 1708 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe

"C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll,start

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 20228

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k LocalService

C:\Windows\SysWOW64\schtasks.exe

schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask

Network

Country Destination Domain Proto
N/A 23.236.181.126:443 23.236.181.126 tcp
N/A 127.0.0.1:20228 tcp
N/A 127.0.0.1:1312 tcp
N/A 23.236.181.126:443 tcp
N/A 127.0.0.1:20228 tcp

Files

memory/2044-54-0x0000000000A30000-0x0000000000C7B000-memory.dmp

memory/2044-55-0x0000000075631000-0x0000000075633000-memory.dmp

memory/2008-56-0x0000000000000000-mapping.dmp

memory/2044-57-0x0000000000A30000-0x0000000000C7B000-memory.dmp

memory/2044-60-0x0000000002520000-0x00000000028A5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

MD5 3ad9ea794298c33dcb7d00502871d770
SHA1 c6998bc26c35a849b0574f6a4c25e526274e9535
SHA256 f0aa0b64a924bea8a0178440ca632f93bd9a6af66dbfa7c7b12816fb8498d6cf
SHA512 fca859c909cde029dafa0fd851d18c2ae844b7a13b3ce3939aed38d22bb2efb8cbf588693a7cb68647baf3152e577fd9f0008eadb25ed73ac05c69c8a8094f6c

\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

MD5 3ad9ea794298c33dcb7d00502871d770
SHA1 c6998bc26c35a849b0574f6a4c25e526274e9535
SHA256 f0aa0b64a924bea8a0178440ca632f93bd9a6af66dbfa7c7b12816fb8498d6cf
SHA512 fca859c909cde029dafa0fd851d18c2ae844b7a13b3ce3939aed38d22bb2efb8cbf588693a7cb68647baf3152e577fd9f0008eadb25ed73ac05c69c8a8094f6c

\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

MD5 3ad9ea794298c33dcb7d00502871d770
SHA1 c6998bc26c35a849b0574f6a4c25e526274e9535
SHA256 f0aa0b64a924bea8a0178440ca632f93bd9a6af66dbfa7c7b12816fb8498d6cf
SHA512 fca859c909cde029dafa0fd851d18c2ae844b7a13b3ce3939aed38d22bb2efb8cbf588693a7cb68647baf3152e577fd9f0008eadb25ed73ac05c69c8a8094f6c

memory/2044-66-0x0000000000400000-0x0000000000791000-memory.dmp

memory/2008-65-0x0000000001F60000-0x00000000021D1000-memory.dmp

\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

MD5 3ad9ea794298c33dcb7d00502871d770
SHA1 c6998bc26c35a849b0574f6a4c25e526274e9535
SHA256 f0aa0b64a924bea8a0178440ca632f93bd9a6af66dbfa7c7b12816fb8498d6cf
SHA512 fca859c909cde029dafa0fd851d18c2ae844b7a13b3ce3939aed38d22bb2efb8cbf588693a7cb68647baf3152e577fd9f0008eadb25ed73ac05c69c8a8094f6c

\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

MD5 3ad9ea794298c33dcb7d00502871d770
SHA1 c6998bc26c35a849b0574f6a4c25e526274e9535
SHA256 f0aa0b64a924bea8a0178440ca632f93bd9a6af66dbfa7c7b12816fb8498d6cf
SHA512 fca859c909cde029dafa0fd851d18c2ae844b7a13b3ce3939aed38d22bb2efb8cbf588693a7cb68647baf3152e577fd9f0008eadb25ed73ac05c69c8a8094f6c

memory/2008-67-0x0000000001F60000-0x00000000021D1000-memory.dmp

memory/2044-68-0x0000000000400000-0x0000000000791000-memory.dmp

memory/2008-69-0x0000000001F60000-0x00000000021D1000-memory.dmp

memory/2008-70-0x00000000034D0000-0x0000000003BF5000-memory.dmp

memory/2008-71-0x00000000034D0000-0x0000000003BF5000-memory.dmp

memory/2008-73-0x00000000034D0000-0x0000000003BF5000-memory.dmp

memory/2008-74-0x00000000034D0000-0x0000000003BF5000-memory.dmp

memory/2008-75-0x0000000003C00000-0x0000000003D40000-memory.dmp

memory/2008-76-0x0000000003C00000-0x0000000003D40000-memory.dmp

memory/2008-77-0x0000000003ED0000-0x0000000004010000-memory.dmp

memory/1708-78-0x0000000000290000-0x00000000004A9000-memory.dmp

memory/2008-80-0x0000000003ED0000-0x0000000004010000-memory.dmp

memory/2008-81-0x0000000003C00000-0x0000000003D40000-memory.dmp

memory/2008-82-0x0000000003C00000-0x0000000003D40000-memory.dmp

memory/1708-83-0x00000000FF113CEC-mapping.dmp

memory/1708-84-0x00000000020E0000-0x0000000002220000-memory.dmp

memory/1708-85-0x00000000020E0000-0x0000000002220000-memory.dmp

memory/1708-86-0x000007FEFC201000-0x000007FEFC203000-memory.dmp

memory/1708-87-0x0000000000290000-0x00000000004A9000-memory.dmp

memory/1708-88-0x0000000001EB0000-0x00000000020DA000-memory.dmp

memory/2008-89-0x00000000034D0000-0x0000000003BF5000-memory.dmp

\??\c:\program files (x86)\microsoft sync framework\v1.0\dwtrig20.dll

MD5 31aa7bfe827ca76287a2555900c1dc31
SHA1 e233a491257871d371ff7db7e0b2a4ebea172132
SHA256 457962cf09677d6888f430043582bf086f7460f522d7a1d4fc6e222cfe04f058
SHA512 e26dc1bccb4eedc3ed3a04fa4227df8bcc5625337d584c0dd6cbafaddd7b46028b4beb255e745ca4e06bc57464cd4b9e8902c8d1085898fc5e17d5cc351f0cd6

\Program Files (x86)\Microsoft Sync Framework\v1.0\DWTRIG20.dll

MD5 31aa7bfe827ca76287a2555900c1dc31
SHA1 e233a491257871d371ff7db7e0b2a4ebea172132
SHA256 457962cf09677d6888f430043582bf086f7460f522d7a1d4fc6e222cfe04f058
SHA512 e26dc1bccb4eedc3ed3a04fa4227df8bcc5625337d584c0dd6cbafaddd7b46028b4beb255e745ca4e06bc57464cd4b9e8902c8d1085898fc5e17d5cc351f0cd6

memory/1684-92-0x00000000022C0000-0x0000000002531000-memory.dmp

memory/1684-94-0x00000000022C0000-0x0000000002531000-memory.dmp

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms

MD5 e4df12694bb232e181ce359c6ccc4b8b
SHA1 635891358e6b39e180f628feca901b2d11f1c34a
SHA256 34aff42438ba883f180da0f4a78163b951add412feec65a293768efe152713a3
SHA512 a4a29e44538a2274ec680554c9f1207d62b6b30a950a9a4914bdc7cef2c1cc22c98598055b1f79410ff5385ea30f8d0e001eb36c0f08f13a5b2b28671dac511d

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\SGRES.DLL.trx_dll

MD5 1238a2868702cdd6ec94b555b168dd23
SHA1 aa903147fded3d3f969b4774714592531fdaf309
SHA256 2c9da56af802bb740eeefb994388fe3fbe1299a1223b7a970bcc293dc245117f
SHA512 aeefd1866b9fb6b1a5a875528e37e3ba37cb6bfd36ade3c84a08880e7777fa3e2b3c19c29c4cf844f97168fdfeaea035fd262f19be9e561df8ff85f4ca36547a

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Math Input Panel.lnk

MD5 89084f87c584fcec4b67b1d31c91ae5f
SHA1 448190716703c7a84bd091f28c8a3ef51cb4c6f2
SHA256 e71b20ce7fce2136c77557d83fc5e144fb0f2e33211b091dc3581eea985ea0db
SHA512 8e18a7eb781545bc8b49833d700f309533a2e94acf6cc5584b94367c0ac582e571167e0c3c615c3084ba42aedbf886e059cc4713e1670f2d42e951a1142e58e6

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\INDEX.000

MD5 023d87454619d85a090724584853cc2e
SHA1 b110e30707b43c7b56250d763aa9d26b50681078
SHA256 3af0202ed8f8df6099e006dc65dbc1d9cbb289231e15a61deae096761e9c3670
SHA512 dd5ffea28b3fdf22216a426f893d61fef083b55f9d31574e205307b342822e6ab1307396c22f37279f1f33e4fd6536395a0518b8b20392424141e9147dbc70d8

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Help_MValidator.H1D

MD5 f9dbc44589bc8fdc6a28ee520581a00d
SHA1 394237a85bdff84682ee17048a5cd67fb1c63ec5
SHA256 f7762966d5e984a9da4556960417f2197bdf951dffa670c819feacef86d49395
SHA512 17bf442dd79f0a405850b09505b935b6a81a8e6042169bace3606bff3d30a80df3cd65621141294798202ade8a05908a4e3e95512074c1a84c1efc8fa12b2004

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Ringtone 04.wma

MD5 5475833fc3e3a5f7f33ea4f86ac68d80
SHA1 d6fa5d34da54b3d42925221b228ca9b8d5f15616
SHA256 3062736db799a15d645e7bddbb24f019cb50454e257aa7ac8e67a3d3d32bc868
SHA512 249816801407b9314876489a364730de5d05f9f6f0ee0491497a036560abefd01baa66b524942f53be98a895b00eb85a66be19d76dd88d6ff61ce4d451e71542

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\directories.acrodata

MD5 874cefb76c681117882796730d3edfca
SHA1 49dc3745d5ee5a3328a3f1e08b08d126ea570580
SHA256 75bdd6932cbb98d11710f1c6738f2f00a5439e4c100f9eb4cb7809c730ad8eb6
SHA512 c4ed39dd3857642c1e0949a7cbee674f9a264e911681763f4319b7e23d9fb3887708fffce41d0dd5b3dd7f3408f05be0052c55b0a93668ef26cfa30c160c9d65

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\cache.dat

MD5 3819a3d096da56e9a1109d701e2c505f
SHA1 22d9f481470b4c5b63e61eb0df902eb40da78abd
SHA256 cc0b6f14bd6c943ca31ac378a6bbde7ffa5d360d7fdfa36c63a11e6ba43957b6
SHA512 bec3880060981b29c82866291afa5aac40c0d3da85fa2920e0b458deca8f3c2e117381b642db77fc67865dfc61c76b5215840962788b5a6a403eadea0b62e573

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Paint.lnk

MD5 4eff26ba8f9a573ba61767fe0db43dd6
SHA1 abb4a96905357eb3711fa4ce97b7df94d8a4d653
SHA256 2ab59c9064abefde7a1e13ad8d92b4700bc4c3e38850a3b724fe854ef7ae0eed
SHA512 5406cf506f70de3c30fbeb107ed398a8f5b9c5227f3c5cb7b5b77c033d4b5784151fe18d1b4655638876f38cbf4e18e73b9216791ac1cac12d93f2c8c3279053

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\usertile19.bmp

MD5 df26b0a9cf69230bb9a9c49dc30831c3
SHA1 ebbcaa79fd8797996a4704849c6f41702b993daf
SHA256 80134f6d607ea57b73d967361ae39ce71b3339b830cd5382c0b86affdf1df92f
SHA512 c49e63224ef08de54a10ea9a656b5f14e0e26d54ae2519019dd3584db768832c21729d046c6dd84b7893c3156bbf3e8e312e01480fdf79d122b3f88a8ae916a8

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Snipping Tool.lnk

MD5 68890917f55238027886315b456b877e
SHA1 f13e1c00f22cdb65cbb2b3e9c39854992e897d5d
SHA256 55c94df07173606e0641363f960134d25160ef9cdafd32a7ac5be4cb0806402f
SHA512 7e651aac5d5facd016f34b3826b08ec8ef71158b7152ef65012d186443670bf6f5327fa1de12f1ee2a203e683cd8c139d77347d51fc6c3b45b83197f8ce2cb6c

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

memory/1364-110-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-12-19 13:19

Reported

2022-12-19 13:21

Platform

win10v2004-20220812-en

Max time kernel

88s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe"

Signatures

Danabot

trojan banker danabot

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe

"C:\Users\Admin\AppData\Local\Temp\0bb2b15ca73128dbc816ea4ed583119c.exe"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll,start

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4456 -ip 4456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 480

Network

Country Destination Domain Proto
N/A 40.79.141.153:443 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.220.29:80 tcp

Files

memory/4456-132-0x0000000000A9D000-0x0000000000CE8000-memory.dmp

memory/4456-133-0x0000000002690000-0x0000000002A15000-memory.dmp

memory/3400-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

MD5 ae978613354d7feee71b2ea7ca999d8c
SHA1 137b0205d39c1d63f856f8b7666e0afc592c5922
SHA256 84510975754ef63e6160f3234296af1f7d95ae5d4159d29fc56e802957d15f2a
SHA512 ed86b1c0580bd8ab5be644e34cab8963a70dfe3e8dd79953c4f3bcffc26d7e5a2a387608eb00be97add7a26d477992e76b181efa5f6d19bad2cf876ee261b850

memory/3400-138-0x0000000001F30000-0x00000000021A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

MD5 ae978613354d7feee71b2ea7ca999d8c
SHA1 137b0205d39c1d63f856f8b7666e0afc592c5922
SHA256 84510975754ef63e6160f3234296af1f7d95ae5d4159d29fc56e802957d15f2a
SHA512 ed86b1c0580bd8ab5be644e34cab8963a70dfe3e8dd79953c4f3bcffc26d7e5a2a387608eb00be97add7a26d477992e76b181efa5f6d19bad2cf876ee261b850

C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

MD5 ae978613354d7feee71b2ea7ca999d8c
SHA1 137b0205d39c1d63f856f8b7666e0afc592c5922
SHA256 84510975754ef63e6160f3234296af1f7d95ae5d4159d29fc56e802957d15f2a
SHA512 ed86b1c0580bd8ab5be644e34cab8963a70dfe3e8dd79953c4f3bcffc26d7e5a2a387608eb00be97add7a26d477992e76b181efa5f6d19bad2cf876ee261b850

memory/4456-139-0x0000000000400000-0x0000000000791000-memory.dmp

memory/3400-140-0x0000000001F30000-0x00000000021A1000-memory.dmp

memory/3400-141-0x0000000001F30000-0x00000000021A1000-memory.dmp