Analysis
- max time kernel
134s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
15/02/2024, 05:08
General
- Target 2c5ea723530fa9428e3357bb89f9200a7fa05dedfb3c9f1454acbc27751c8056.js
- Size 5KB
- Sample240215-fs2edaab26
- SHA256 2c5ea723530fa9428e3357bb89f9200a7fa05dedfb3c9f1454acbc27751c8056
Malware Config
Extracted
-
danabot
-
type
loader
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\2c5ea723530fa9428e3357bb89f9200a7fa05dedfb3c9f1454acbc27751c8056.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" /B C:\Users\Admin\AppData\Local\Temp\VCwBwWTaJs.dll,start2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" /B C:\Users\Admin\AppData\Local\Temp\VCwBwWTaJs.dll,start3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask4⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Foewwp
VCwBwWTaJs.dll
VCwBwWTaJs.dll
__PSScriptPolicyTest_zwmkeu1g.axr.ps1
memory/4248-93-0x0000000007B30000-0x00000000081AA000-memory.dmp
memory/4248-92-0x00000000073D0000-0x0000000007473000-memory.dmp
memory/4248-102-0x0000000007810000-0x0000000007818000-memory.dmp
memory/4248-101-0x0000000007830000-0x000000000784A000-memory.dmp
memory/4248-100-0x0000000007730000-0x0000000007744000-memory.dmp
memory/4248-99-0x0000000007720000-0x000000000772E000-memory.dmp
memory/4248-97-0x00000000076F0000-0x0000000007701000-memory.dmp
memory/4248-96-0x0000000007770000-0x0000000007806000-memory.dmp
memory/4248-95-0x0000000007560000-0x000000000756A000-memory.dmp
memory/4248-94-0x00000000074F0000-0x000000000750A000-memory.dmp
memory/4248-65-0x0000000005200000-0x0000000005222000-memory.dmp
memory/4248-76-0x0000000005CF0000-0x0000000005D56000-memory.dmp
memory/4248-91-0x0000000006780000-0x000000000679E000-memory.dmp
memory/4248-81-0x000000006CE10000-0x000000006CE5C000-memory.dmp
memory/4248-71-0x0000000005B10000-0x0000000005B76000-memory.dmp
memory/4248-79-0x0000000006200000-0x000000000624C000-memory.dmp
memory/4248-63-0x0000000004C10000-0x0000000004C46000-memory.dmp
memory/4248-64-0x00000000052A0000-0x00000000058C8000-memory.dmp
memory/4248-78-0x00000000061C0000-0x00000000061DE000-memory.dmp
memory/4248-77-0x0000000005D60000-0x00000000060B4000-memory.dmp
memory/4248-80-0x00000000067C0000-0x00000000067F2000-memory.dmp
memory/4536-6-0x00000000045C0000-0x0000000005451000-memory.dmp
memory/4536-59-0x0000000005460000-0x0000000005C62000-memory.dmp
memory/4536-7-0x0000000005460000-0x0000000005C62000-memory.dmp
memory/4536-62-0x0000000005460000-0x0000000005C62000-memory.dmp
memory/4536-4-0x0000000074140000-0x0000000074CA6000-memory.dmp
memory/4536-43-0x00000000045C0000-0x0000000005451000-memory.dmp
memory/4536-42-0x0000000077242000-0x0000000077243000-memory.dmp
memory/4536-41-0x0000000074140000-0x0000000074CA6000-memory.dmp
memory/4536-5-0x0000000074140000-0x0000000074CA6000-memory.dmp
memory/4536-15-0x0000000005460000-0x0000000005C62000-memory.dmp
memory/4536-14-0x0000000005460000-0x0000000005C62000-memory.dmp
memory/4536-13-0x0000000005460000-0x0000000005C62000-memory.dmp
memory/4536-12-0x0000000005460000-0x0000000005C62000-memory.dmp
memory/4536-98-0x0000000005460000-0x0000000005C62000-memory.dmp
memory/4536-11-0x0000000005460000-0x0000000005C62000-memory.dmp
memory/4536-10-0x0000000005460000-0x0000000005C62000-memory.dmp
memory/4536-9-0x0000000005460000-0x0000000005C62000-memory.dmp
memory/4536-8-0x0000000077242000-0x0000000077243000-memory.dmp
memory/4536-104-0x0000000005460000-0x0000000005C62000-memory.dmp