danabot | 21917cd411471ca69b1c99e31021daca3abb99230847fabd831efa9f262c9d91

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a9c29b7c86f85ba69867fe9eca96032.dll
Size 17.5MB
Sample240214-drg81agg68
SHA256 21917cd411471ca69b1c99e31021daca3abb99230847fabd831efa9f262c9d91
MD5 9a9c29b7c86f85ba69867fe9eca96032
SHA1 f04ac642fd12828ff29ee7a80dca4fc06e9e9ed6
SHA512 0d1020d9ea58c043d79dedc277f499712cced5525e376148e790b0b822f8997553a3d971eddb5dcf5f7c91c32ce76332e2d82bc9c1b9adfaed7ae31fd173e050
SSDEEP 393216:09au43eWk/QTynLEuIGw5Eio0Puxj/792+rOZTlEwLNPFqCxnhmq:0cRjTynLOc/tglEwLNPFqCxnh3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot 15 banker collection discovery spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1987

Botnet

192.52.166.169:443
173.254.204.95:443
192.52.167.45:443

Attributes

embedded_hash
D6A9A294BFDC6F13BFCC2AB0FA9B54B9
type
main

rsa_privkey.plain

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 10 IoCs

flow	pid	Process
10	3116	RUNDLL32.EXE
29	3116	RUNDLL32.EXE
36	3116	RUNDLL32.EXE
40	3116	RUNDLL32.EXE
47	3116	RUNDLL32.EXE
50	3116	RUNDLL32.EXE
55	3116	RUNDLL32.EXE
59	3116	RUNDLL32.EXE
74	3116	RUNDLL32.EXE
75	3116	RUNDLL32.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	RUNDLL32.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RUNDLL32.EXE

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RUNDLL32.EXE
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	RUNDLL32.EXE
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	RUNDLL32.EXE
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	RUNDLL32.EXE

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6754C3508A3061B61DFCC20935EB775C0C36CC81	RUNDLL32.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6754C3508A3061B61DFCC20935EB775C0C36CC81\Blob = 0300000001000000140000006754c3508a3061b61dfcc20935eb775c0c36cc8120000000010000004e0200003082024a308201b3a00302010202082a543038018bd86b300d06092a864886f70d01010b050030503116301406035504030c0d495337524720526f6f7420583131293027060355040a0c20496e7465726e65742053656375726974792052657365617263682047726f7570310b3009060355040613025553301e170d3232303231343033313433315a170d3236303231333033313433315a30503116301406035504030c0d495337524720526f6f7420583131293027060355040a0c20496e7465726e65742053656375726974792052657365617263682047726f7570310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100b0eef53ae7fc53fb10f76a6dc648df205d8f38510084488aab4e896ce7ff0904a1c14903db9f4ee9097f90dc1e44fc9fcfa459b0c4731ccb9d500446d1cacdb8258e6da04c961f0dfd76bf454ffd592655a4ca19c6560e6d9cc723c0c6643dc8eca6016b3a6cc390d6db9f15b982179d86e96c931032158e2ac29f17b8dba8a70203010001a32d302b300f0603551d130101ff040530030101ff30180603551d110411300f820d495337524720526f6f74205831300d06092a864886f70d01010b05000381810001bed709b120799873f3fda2fad7084fc19a6b187e227ee591c8a44c6110d5626766b6bd93e31cb459d09ebc21b60d2038ab59b896bb38e3f0532f753ddac0c0c9054137cf09c2fd63975271dbcaf0d367ec3266386b38d23c8c0ef129fad3c928e4c259aa8941b190ccfdfaecb89b6b53ae12461f7c730af59a49ca46a049cd	RUNDLL32.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3116	RUNDLL32.EXE
3116	RUNDLL32.EXE
3116	RUNDLL32.EXE
3116	RUNDLL32.EXE
3116	RUNDLL32.EXE
3116	RUNDLL32.EXE
3160	powershell.exe
3160	powershell.exe
3116	RUNDLL32.EXE
3116	RUNDLL32.EXE
4524	powershell.exe
4524	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	RUNDLL32.EXE
Token: SeDebugPrivilege	3160	powershell.exe
Token: SeDebugPrivilege	4524	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3116	RUNDLL32.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3628	2368	rundll32.exe	84
PID 2368 wrote to memory of 3628	2368	rundll32.exe	84
PID 2368 wrote to memory of 3628	2368	rundll32.exe	84
PID 3628 wrote to memory of 3116	3628	rundll32.exe	85
PID 3628 wrote to memory of 3116	3628	rundll32.exe	85
PID 3628 wrote to memory of 3116	3628	rundll32.exe	85
PID 3116 wrote to memory of 3160	3116	RUNDLL32.EXE	86
PID 3116 wrote to memory of 3160	3116	RUNDLL32.EXE	86
PID 3116 wrote to memory of 3160	3116	RUNDLL32.EXE	86
PID 3116 wrote to memory of 4524	3116	RUNDLL32.EXE	89
PID 3116 wrote to memory of 4524	3116	RUNDLL32.EXE	89
PID 3116 wrote to memory of 4524	3116	RUNDLL32.EXE	89
PID 4524 wrote to memory of 4488	4524	powershell.exe	93
PID 4524 wrote to memory of 4488	4524	powershell.exe	93
PID 4524 wrote to memory of 4488	4524	powershell.exe	93
PID 3116 wrote to memory of 2544	3116	RUNDLL32.EXE	95
PID 3116 wrote to memory of 2544	3116	RUNDLL32.EXE	95
PID 3116 wrote to memory of 2544	3116	RUNDLL32.EXE	95
PID 3116 wrote to memory of 3616	3116	RUNDLL32.EXE	97
PID 3116 wrote to memory of 3616	3116	RUNDLL32.EXE	97
PID 3116 wrote to memory of 3616	3116	RUNDLL32.EXE	97

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a9c29b7c86f85ba69867fe9eca96032.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a9c29b7c86f85ba69867fe9eca96032.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\SysWOW64\RUNDLL32.EXE
    C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\9a9c29b7c86f85ba69867fe9eca96032.dll,ZFETUWM=
    3⤵
    - Blocklisted process makes network request
    - Checks computer location settings
    - Accesses Microsoft Outlook accounts
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:3116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp5062.tmp.ps1"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3160
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp6534.tmp.ps1"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\Windows\SysWOW64\nslookup.exe
        
        "C:\Windows\system32\nslookup.exe" -type=any localhost
        5⤵
        
        PID:4488
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
      4⤵
      PID:2544
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
      4⤵
      PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 139a32ad96800367dc709be507e2b78e667610000be7c68f94c174e6fa60f84f
MD5 6ad58b45ba900fe2b784c35fe1ddd496
SHA1 7701cf4dfebc92b77e3d16a4094dac0def34f13a
SHA512 168f58da543d5c3a645c9a51916528c8e291f0f49069fb8567328e6960874a97026839a31a3505bcd1cc26320a477fbd095406ff3e12c4419c5429b729cd9c1a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 7e75938583031d01bbb75c518a6e5c29d63f849ffb83496d2f7ea16524d62c95
MD5 17deb7c9e1c55aa1a04c0f80fe481e13
SHA1 0618d42338ea00c6075bc5018a8e647d5a17bbe7
SHA512 5c4f70bef6b47f05d83fd9b035b586c442381717a874a87acbc422ab78b3bcf98ca27e3e62aef05e239ef220c4a875c47ca8be9f137e031856c2f4d09fb11f22
SSDEEP 384:Xrf+JJ9i+yYYqSnGWb+Gpdlj2T9K6seYNYIL/P74zmg0slGBaa+I/11P7WqbTm:7fpYkGQ+GDx2T9NRILXgmqGMa+I0
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_42n3twmu.xtj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_42n3twmu.xtj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmp5062.tmp.ps1

Path C:\Users\Admin\AppData\Local\Temp\tmp5062.tmp.ps1
Size 261B
SHA256 5788d61ce8dab82b327265b14d5a754d028c77e4c09bc5a85698a312ac9490b9
MD5 0fd1f28f01433ee6e89dbb7de7dfdf06
SHA1 a59c05eed48a9c5c45fc0ddafa7e460b80787f63
SHA512 b506e56e0a9a50f116420533a3dc921c51a83fd209c9b3e6dfea91db34c8adfde259be8bac2df5e07e06398428c389b7f503a52bad093914df037744addceab9
MD5 SHA1 SHA512

Submit Download

tmp5063.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5063.tmp
Size 1KB
SHA256 0600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046
MD5 c416c12d1b2b1da8c8655e393b544362
SHA1 fb1a43cd8e1c556c2d25f361f42a21293c29e447
SHA512 cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c
MD5 SHA1 SHA512

Submit Download

tmp6534.tmp.ps1

Path C:\Users\Admin\AppData\Local\Temp\tmp6534.tmp.ps1
Size 80B
SHA256 92a90fb158764543c6ea2a8ca2d70f23007f01a29c19681b82a4793d368e86c5
MD5 ef48d46413f5cce119090bc08f3790a1
SHA1 63451cb913f1545ebae1558b372eab2d33f8c102
SHA512 271c189929cea736e61e92f691423436b7f77228a2c89114b313be440f044b254a363a139ecf850051f5d88574fd8d3793067a00bd3287081249ece00d41800e
MD5 SHA1 SHA512

Submit Download

tmp6535.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6535.tmp
Size 86B
SHA256 0c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1
MD5 1860260b2697808b80802352fe324782
SHA1 f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b
SHA512 d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f
MD5 SHA1 SHA512

Submit Download

memory/3116-3-0x0000000003A70000-0x0000000003A71000-memory.dmp

Download

memory/3116-70-0x0000000002240000-0x00000000034D6000-memory.dmp

Download

memory/3116-73-0x0000000002240000-0x00000000034D6000-memory.dmp

Download

memory/3116-75-0x0000000002240000-0x00000000034D6000-memory.dmp

Download

memory/3116-76-0x0000000002240000-0x00000000034D6000-memory.dmp

Download

memory/3116-2-0x0000000002240000-0x00000000034D6000-memory.dmp

Download

memory/3116-84-0x0000000002240000-0x00000000034D6000-memory.dmp

Download

memory/3160-34-0x0000000007B90000-0x000000000820A000-memory.dmp

Download

memory/3160-17-0x0000000005490000-0x00000000054B2000-memory.dmp

Download

memory/3160-30-0x0000000006320000-0x000000000633E000-memory.dmp

Download

memory/3160-33-0x0000000006670000-0x000000000667A000-memory.dmp

Download

memory/3160-12-0x00000000012E0000-0x0000000001316000-memory.dmp

Download

memory/3160-35-0x00000000068B0000-0x00000000068CA000-memory.dmp

Download

memory/3160-36-0x0000000006950000-0x0000000006958000-memory.dmp

Download

memory/3160-40-0x0000000071B90000-0x0000000072340000-memory.dmp

Download

memory/3160-29-0x0000000005E90000-0x00000000061E4000-memory.dmp

Download

memory/3160-24-0x0000000005D20000-0x0000000005D86000-memory.dmp

Download

memory/3160-13-0x0000000071B90000-0x0000000072340000-memory.dmp

Download

memory/3160-14-0x0000000001290000-0x00000000012A0000-memory.dmp

Download

memory/3160-15-0x0000000001290000-0x00000000012A0000-memory.dmp

Download

memory/3160-16-0x0000000005680000-0x0000000005CA8000-memory.dmp

Download

memory/3160-18-0x0000000005CB0000-0x0000000005D16000-memory.dmp

Download

memory/3160-31-0x0000000006380000-0x00000000063CC000-memory.dmp

Download

memory/3628-0-0x00000000023D0000-0x0000000003666000-memory.dmp

Download

memory/3628-1-0x0000000003D20000-0x0000000003D21000-memory.dmp

Download

memory/4524-62-0x0000000006760000-0x00000000067AC000-memory.dmp

Download

memory/4524-66-0x00000000714A0000-0x0000000071C50000-memory.dmp

Download

memory/4524-51-0x00000000060A0000-0x00000000063F4000-memory.dmp

Download

memory/4524-49-0x00000000051F0000-0x0000000005200000-memory.dmp

Download

memory/4524-50-0x00000000051F0000-0x0000000005200000-memory.dmp

Download

memory/4524-48-0x00000000714A0000-0x0000000071C50000-memory.dmp

Download