Analysis

  • max time kernel
    145s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-11-2024 03:05

General

  • Target

    DanaBot.exe

  • Size

    2.7MB

  • MD5

    48d8f7bbb500af66baa765279ce58045

  • SHA1

    2cdb5fdeee4e9c7bd2e5f744150521963487eb71

  • SHA256

    db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

  • SHA512

    aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

  • SSDEEP

    49152:bbevayZlMTWkygVy0nQZfVY2BtZzpPL4PuQ65+6Dv7m0KXTn:bbexZlMQcEVY2BtZzpPL4WQI9U

Malware Config

Extracted

Family

danabot

C2

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Danabot family
  • Danabot x86 payload 1 IoCs

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

  • Blocklisted process makes network request 8 IoCs
  • Loads dropped DLL 4 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 37 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DanaBot.exe
    "C:\Users\Admin\AppData\Local\Temp\DanaBot.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4672
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\DanaBot.dll f1 C:\Users\Admin\AppData\Local\Temp\DanaBot.exe@4672
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2228
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\DanaBot.dll,f0
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3760
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 460
      2⤵
      • Program crash
      PID:4272
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4672 -ip 4672
    1⤵
      PID:2684
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3604
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2712
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4436

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\DanaBot.dll

        Filesize

        2.4MB

        MD5

        7e76f7a5c55a5bc5f5e2d7a9e886782b

        SHA1

        fc500153dba682e53776bef53123086f00c0e041

        SHA256

        abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

        SHA512

        0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

      • memory/2228-9-0x0000000002930000-0x0000000002931000-memory.dmp

        Filesize

        4KB

      • memory/2228-8-0x0000000002370000-0x00000000025DB000-memory.dmp

        Filesize

        2.4MB

      • memory/2712-27-0x000001A6FBBE0000-0x000001A6FBBE1000-memory.dmp

        Filesize

        4KB

      • memory/2712-33-0x000001A6FBBE0000-0x000001A6FBBE1000-memory.dmp

        Filesize

        4KB

      • memory/2712-28-0x000001A6FBBE0000-0x000001A6FBBE1000-memory.dmp

        Filesize

        4KB

      • memory/2712-29-0x000001A6FBBE0000-0x000001A6FBBE1000-memory.dmp

        Filesize

        4KB

      • memory/2712-30-0x000001A6FBBE0000-0x000001A6FBBE1000-memory.dmp

        Filesize

        4KB

      • memory/2712-31-0x000001A6FBBE0000-0x000001A6FBBE1000-memory.dmp

        Filesize

        4KB

      • memory/2712-32-0x000001A6FBBE0000-0x000001A6FBBE1000-memory.dmp

        Filesize

        4KB

      • memory/2712-22-0x000001A6FBBE0000-0x000001A6FBBE1000-memory.dmp

        Filesize

        4KB

      • memory/2712-23-0x000001A6FBBE0000-0x000001A6FBBE1000-memory.dmp

        Filesize

        4KB

      • memory/2712-21-0x000001A6FBBE0000-0x000001A6FBBE1000-memory.dmp

        Filesize

        4KB

      • memory/3760-18-0x0000000002500000-0x000000000276B000-memory.dmp

        Filesize

        2.4MB

      • memory/3760-16-0x0000000002500000-0x000000000276B000-memory.dmp

        Filesize

        2.4MB

      • memory/3760-12-0x0000000002500000-0x000000000276B000-memory.dmp

        Filesize

        2.4MB

      • memory/4672-1-0x0000000002890000-0x0000000002B11000-memory.dmp

        Filesize

        2.5MB

      • memory/4672-3-0x0000000000400000-0x000000000069A000-memory.dmp

        Filesize

        2.6MB

      • memory/4672-13-0x0000000000400000-0x0000000000AAD000-memory.dmp

        Filesize

        6.7MB

      • memory/4672-15-0x0000000000400000-0x000000000069A000-memory.dmp

        Filesize

        2.6MB

      • memory/4672-14-0x0000000002B20000-0x0000000002DAD000-memory.dmp

        Filesize

        2.6MB

      • memory/4672-2-0x0000000002B20000-0x0000000002DAD000-memory.dmp

        Filesize

        2.6MB