Analysis
- max time kernel
142s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
29/01/2024, 16:07
General
- Target 80450a6fd44277fa7c6883ee59093f72.dll
- Size 5.7MB
- Sample240129-tk5nqafbej
- SHA256 ea0af0074cddd3d6de2f641f5f0e7dfb5170dfc44a8661b06075cf32dfc3cf16
Malware Config
Extracted
-
danabot
-
1827
-
3
-
23.106.123.141:443
-
37.220.31.94:443
-
23.106.123.185:443
-
192.210.198.12:443
-
embedded_hash
AEF96B4D339B580ABB737F203C2D0F52
-
type
main
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Blocklisted process makes network request 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\80450a6fd44277fa7c6883ee59093f72.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\80450a6fd44277fa7c6883ee59093f72.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\80450a6fd44277fa7c6883ee59093f72.dll,mGI23⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
CURRENT
128.png
Gujekofbuuhnk.tmp
memory/1272-8-0x0000000002FE0000-0x0000000003640000-memory.dmp
memory/1272-9-0x0000000002FE0000-0x0000000003640000-memory.dmp
memory/1272-5-0x0000000002FE0000-0x0000000003640000-memory.dmp
memory/1272-6-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/1272-7-0x0000000002FE0000-0x0000000003640000-memory.dmp
memory/1272-24-0x0000000002FE0000-0x0000000003640000-memory.dmp
memory/1272-19-0x0000000002FE0000-0x0000000003640000-memory.dmp
memory/1272-4-0x0000000002320000-0x00000000028DB000-memory.dmp
memory/1272-20-0x0000000002320000-0x00000000028DB000-memory.dmp
memory/1272-23-0x0000000002FE0000-0x0000000003640000-memory.dmp
memory/2264-21-0x0000000002BE0000-0x0000000003240000-memory.dmp
memory/2264-0-0x0000000002090000-0x000000000264B000-memory.dmp
memory/2264-3-0x0000000002BE0000-0x0000000003240000-memory.dmp
memory/2264-2-0x0000000003460000-0x0000000003461000-memory.dmp
memory/2264-1-0x0000000002BE0000-0x0000000003240000-memory.dmp