Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
18/03/2024, 16:41
General
- Target d4010f789559c6c981ab6d80854e9576.dll
- Size 5.7MB
- Sample240318-t69vkadc85
- SHA256 10eb11561e10d9c483b9acee032cdcfb5ee6218901de951029ddb740b5a99784
Malware Config
Extracted
-
danabot
-
1827
-
3
-
23.106.123.249:443
-
23.106.123.141:443
-
23.254.225.170:443
-
134.119.186.216:443
-
embedded_hash
AEF96B4D339B580ABB737F203C2D0F52
-
type
main
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Blocklisted process makes network request 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4010f789559c6c981ab6d80854e9576.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4010f789559c6c981ab6d80854e9576.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\d4010f789559c6c981ab6d80854e9576.dll,X1gH3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
dfspdzpfhgum.tmp
memory/444-23-0x0000000002390000-0x000000000294A000-memory.dmp
memory/444-22-0x0000000003110000-0x000000000376F000-memory.dmp
memory/444-26-0x0000000003110000-0x000000000376F000-memory.dmp
memory/444-25-0x0000000003110000-0x000000000376F000-memory.dmp
memory/444-4-0x0000000002390000-0x000000000294A000-memory.dmp
memory/444-6-0x0000000003110000-0x000000000376F000-memory.dmp
memory/444-8-0x0000000003110000-0x000000000376F000-memory.dmp
memory/444-9-0x0000000003110000-0x000000000376F000-memory.dmp
memory/444-7-0x0000000002D00000-0x0000000002D01000-memory.dmp
memory/444-10-0x0000000003110000-0x000000000376F000-memory.dmp
memory/4496-2-0x00000000009C0000-0x00000000009C1000-memory.dmp
memory/4496-0-0x00000000033B0000-0x0000000003A0F000-memory.dmp
memory/4496-5-0x00000000033B0000-0x0000000003A0F000-memory.dmp
memory/4496-3-0x0000000001750000-0x0000000001751000-memory.dmp
memory/4496-1-0x00000000033B0000-0x0000000003A0F000-memory.dmp