Analysis
- max time kernel
143s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
13/01/2024, 02:05
General
- Target 57b388d86cf9eeac704fc629587c82bd.exe
- Size 1.2MB
- Sample240113-chzagsaaej
- SHA256 0ffddce470010278a1e5545d5c616def34d6c4b21ac1152a11de5aa48792fb77
Malware Config
Extracted
-
danabot
-
4
-
142.11.244.124:443
-
142.11.206.50:443
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot Loader Component 13 IoCs
- Blocklisted process makes network request 1 IoCs
- Loads dropped DLL 2 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\57b388d86cf9eeac704fc629587c82bd.exe"C:\Users\Admin\AppData\Local\Temp\57b388d86cf9eeac704fc629587c82bd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\57B388~1.TMP,S C:\Users\Admin\AppData\Local\Temp\57B388~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 4442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4432 -ip 44321⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
57B388~1.EXE.tmp
57B388~1.EXE.tmp
57B388~1.TMP
memory/2916-22-0x00000000022A0000-0x00000000023FD000-memory.dmp
memory/2916-23-0x00000000022A0000-0x00000000023FD000-memory.dmp
memory/2916-9-0x00000000022A0000-0x00000000023FD000-memory.dmp
memory/2916-27-0x00000000022A0000-0x00000000023FD000-memory.dmp
memory/2916-26-0x00000000022A0000-0x00000000023FD000-memory.dmp
memory/2916-25-0x00000000022A0000-0x00000000023FD000-memory.dmp
memory/2916-12-0x00000000022A0000-0x00000000023FD000-memory.dmp
memory/2916-20-0x00000000022A0000-0x00000000023FD000-memory.dmp
memory/2916-21-0x00000000022A0000-0x00000000023FD000-memory.dmp
memory/2916-24-0x00000000022A0000-0x00000000023FD000-memory.dmp
memory/4432-5-0x0000000000400000-0x00000000009DE000-memory.dmp
memory/4432-1-0x0000000000AB0000-0x0000000000B9B000-memory.dmp
memory/4432-11-0x0000000000CD0000-0x0000000000DCE000-memory.dmp
memory/4432-10-0x0000000000400000-0x00000000009DE000-memory.dmp
memory/4432-2-0x0000000000CD0000-0x0000000000DCE000-memory.dmp