Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2022, 14:23

General

  • Target

    1011a741bec73841acc4c7f9c9b58492ab3a2a7a09bc2c3afeaea570d12c0ee8.dll

  • Size

    6.0MB

  • MD5

    e6ece3b3fbfd4ec6868c9d808239caae

  • SHA1

    e1af7bc31d0064f312ed489ce20ffa55dd9abeb1

  • SHA256

    1011a741bec73841acc4c7f9c9b58492ab3a2a7a09bc2c3afeaea570d12c0ee8

  • SHA512

    73a3f58a5b74bf42cd50883034156f5426918dd9ea6a8851f08204721921f042d15696c4c89f4f81b3a3703686128aa7cbae7f68e10a035888a492f7407a5c88

  • SSDEEP

    98304:Hz+i/ZUp+6iENc2cvrJvY6gQ4Qlixljx3pj3GWdF8E/vK1JVSP:Tpk+6nc2cvwZLGWD8E/S

Score
10/10

Malware Config

Extracted

Family

danabot

C2

49.0.50.0:57

51.0.52.0:0

53.0.54.0:1200

55.0.56.0:65535

Attributes
  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1011a741bec73841acc4c7f9c9b58492ab3a2a7a09bc2c3afeaea570d12c0ee8.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3180
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\1011a741bec73841acc4c7f9c9b58492ab3a2a7a09bc2c3afeaea570d12c0ee8.dll,#1
      2⤵
      • Checks processor information in registry
      PID:3976

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3976-133-0x0000000002C20000-0x0000000003345000-memory.dmp

    Filesize

    7.1MB

  • memory/3976-134-0x0000000002C21000-0x000000000313B000-memory.dmp

    Filesize

    5.1MB