Analysis
- max time kernel
143s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 03:54
General
- Target e0b47c716f0d29997212ccb7c30686a3.exe
- Size 1.0MB
- Sample240327-egbtxafb2y
- SHA256 e83e6702c3b59f275981161db3eabdb589051a4d36ad2d74c34a8fc45cb31a30
Malware Config
Extracted
-
danabot
-
4
-
142.11.244.124:443
-
142.11.206.50:443
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
Signatures
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot Loader Component 10 IoCs
- Blocklisted process makes network request 1 IoCs
- Loads dropped DLL 2 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0b47c716f0d29997212ccb7c30686a3.exe"C:\Users\Admin\AppData\Local\Temp\e0b47c716f0d29997212ccb7c30686a3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\E0B47C~1.TMP,S C:\Users\Admin\AppData\Local\Temp\E0B47C~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 5082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 32 -ip 321⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3840 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
E0B47C~1.TMP
memory/32-12-0x0000000004C00000-0x0000000004CFD000-memory.dmp
memory/32-1-0x0000000004B10000-0x0000000004BFC000-memory.dmp
memory/32-2-0x0000000004C00000-0x0000000004CFD000-memory.dmp
memory/32-3-0x0000000000400000-0x0000000002D43000-memory.dmp
memory/32-10-0x0000000000400000-0x0000000002D43000-memory.dmp
memory/3672-21-0x0000000000B30000-0x0000000000C8D000-memory.dmp
memory/3672-13-0x0000000000B30000-0x0000000000C8D000-memory.dmp
memory/3672-9-0x0000000000B30000-0x0000000000C8D000-memory.dmp
memory/3672-22-0x0000000000B30000-0x0000000000C8D000-memory.dmp
memory/3672-23-0x0000000000B30000-0x0000000000C8D000-memory.dmp
memory/3672-24-0x0000000000B30000-0x0000000000C8D000-memory.dmp
memory/3672-25-0x0000000000B30000-0x0000000000C8D000-memory.dmp
memory/3672-26-0x0000000000B30000-0x0000000000C8D000-memory.dmp
memory/3672-27-0x0000000000B30000-0x0000000000C8D000-memory.dmp