Analysis

  • max time kernel
    141s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    29-01-2024 10:05

General

  • Target

    7f8f5be06bf789146526e520a66be571.exe

  • Size

    1.2MB

  • MD5

    7f8f5be06bf789146526e520a66be571

  • SHA1

    629681e69d3759d2085aa2c037c8c6fca4045ea2

  • SHA256

    1b6893887051e9bb3155b6a817e71e499dcb5959369391a42b772c0fa75e55fd

  • SHA512

    4c396b8dadfd446f11b644ad33042e0c6fa19b418c02d744f4bda5409732b3b1601cc3bff191cb5a8a10f676672d0c662705420a1b4306f142a6a897a09210aa

  • SSDEEP

    24576:wAUndkOGbeIL4GZfKiE8q34N+/J8b5uRLDOmY1NY6NDaJm6bPCPR:rAkP0GZnEB4NW8bk1D4TY4

Score
10/10

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.124:443

142.11.206.50:443

Attributes
  • embedded_hash

    6AD9FE4F9E491E785665E0D144F61DAB

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f8f5be06bf789146526e520a66be571.exe
    "C:\Users\Admin\AppData\Local\Temp\7f8f5be06bf789146526e520a66be571.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\7F8F5B~1.TMP,S C:\Users\Admin\AppData\Local\Temp\7F8F5B~1.EXE
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7F8F5B~1.TMP

    Filesize

    101KB

    MD5

    17fc0a22c0431ec2f62c3c233f049ff8

    SHA1

    fc5f141ee891f86f172e3b4ee175c33504064616

    SHA256

    28f6b29dd75a1ba32bb40b143cf6823d5f442b7c11d329ca52246250168d8b63

    SHA512

    1726017d48749dbf016c8663e90c102e01214ba55e44161d8cff8e2eff43803891d82cbcfb3d26748d39b96fe0122d77a6ff9aceda2ca17c31c52ad47d547b13

  • \Users\Admin\AppData\Local\Temp\7F8F5B~1.TMP

    Filesize

    112KB

    MD5

    39b30977b2a15193eb69721a7087cd75

    SHA1

    153d635ff65b60d1b07bfb2e678eeb8b24d37dfc

    SHA256

    71cf6c008dcec79b4d77f850646b96dea065620086b52bf573abc38c173e03c2

    SHA512

    1d60a6d50cb09ea72ebd289ed5d90b1ab1a531852a178bdb06abc9e4f8a230310d9d5ba5ec659a84db8997a7092ba0729c2e484bbd07c635057b666dd44eac77

  • memory/1732-2-0x0000000001EC0000-0x0000000001FC0000-memory.dmp

    Filesize

    1024KB

  • memory/1732-1-0x0000000000550000-0x000000000063A000-memory.dmp

    Filesize

    936KB

  • memory/1732-5-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/1732-6-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/1732-0-0x0000000000550000-0x000000000063A000-memory.dmp

    Filesize

    936KB

  • memory/1732-9-0x0000000000550000-0x000000000063A000-memory.dmp

    Filesize

    936KB

  • memory/1732-7-0x0000000001EC0000-0x0000000001FC0000-memory.dmp

    Filesize

    1024KB

  • memory/2668-11-0x0000000000770000-0x00000000008CE000-memory.dmp

    Filesize

    1.4MB

  • memory/2668-12-0x0000000000770000-0x00000000008CE000-memory.dmp

    Filesize

    1.4MB

  • memory/2668-20-0x0000000000770000-0x00000000008CE000-memory.dmp

    Filesize

    1.4MB

  • memory/2668-21-0x0000000000770000-0x00000000008CE000-memory.dmp

    Filesize

    1.4MB

  • memory/2668-22-0x0000000000770000-0x00000000008CE000-memory.dmp

    Filesize

    1.4MB

  • memory/2668-23-0x0000000000770000-0x00000000008CE000-memory.dmp

    Filesize

    1.4MB

  • memory/2668-24-0x0000000000770000-0x00000000008CE000-memory.dmp

    Filesize

    1.4MB

  • memory/2668-25-0x0000000000770000-0x00000000008CE000-memory.dmp

    Filesize

    1.4MB

  • memory/2668-26-0x0000000000770000-0x00000000008CE000-memory.dmp

    Filesize

    1.4MB

  • memory/2668-27-0x0000000000770000-0x00000000008CE000-memory.dmp

    Filesize

    1.4MB