Overview

overview

10

Static

static

3

ecc53e83b5...14.exe

windows7-x64

10

ecc53e83b5...14.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ecc53e83b518a576129ffec83c5598053d7fd0882c261d2f2564d1ed40ca3514.com

  • Size

    4.5MB

  • Sample

    230825-nbjf8sch6v

  • MD5

    e0c0c66b850971fe02264ea61c07e410

  • SHA1

    641f9735953f70a39b3ebf36cbc6f8438549e172

  • SHA256

    ecc53e83b518a576129ffec83c5598053d7fd0882c261d2f2564d1ed40ca3514

  • SHA512

    f99ae9bf78f9290fe023a8d384c7780d065fd76e2d5fae399461b62b15e53bfc2af2630395b55b3f95b6d73b21b1b796a55cff49505f9b04ceb2143749066f23

  • SSDEEP

    98304:SvHdmkDNu0uuWnfEgWRpdFLtnUCVlxinLGZuPKswM9nQBWMqdjvwQB1e:Udm+sjp+5nUMknLSM9eWMqdjvwQB1e

Score
10/10
danabotbankerinjectspersistencespywarestealertrojan

Malware Config

Targets

    • Target

      ecc53e83b518a576129ffec83c5598053d7fd0882c261d2f2564d1ed40ca3514.com

    • Size

      4.5MB

    • MD5

      e0c0c66b850971fe02264ea61c07e410

    • SHA1

      641f9735953f70a39b3ebf36cbc6f8438549e172

    • SHA256

      ecc53e83b518a576129ffec83c5598053d7fd0882c261d2f2564d1ed40ca3514

    • SHA512

      f99ae9bf78f9290fe023a8d384c7780d065fd76e2d5fae399461b62b15e53bfc2af2630395b55b3f95b6d73b21b1b796a55cff49505f9b04ceb2143749066f23

    • SSDEEP

      98304:SvHdmkDNu0uuWnfEgWRpdFLtnUCVlxinLGZuPKswM9nQBWMqdjvwQB1e:Udm+sjp+5nUMknLSM9eWMqdjvwQB1e

    Score
    10/10
    danabotbankerinjectspersistencespywarestealertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot injects module

      injects

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks