danabot | hxxps://picshare[.]hair/image[.]php?id=RMHUD7[.]png

Analysis

max time kernel
240s
max time network
241s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 17:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://picshare.hair/image.php?id=RMHUD7.png

Score

10^/10

danabot banker botnet discovery trojan

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
behavioral1/files/0x0008000000000711-463.dat	family_danabot

Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow	pid	Process
115	5028	rundll32.exe
119	5028	rundll32.exe
120	5028	rundll32.exe
121	5028	rundll32.exe
122	5028	rundll32.exe
123	5028	rundll32.exe
124	5028	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

Processes:

DanaBot.exeDanaBot.exe

pid	Process
4664	DanaBot.exe
4280	DanaBot.exe

Loads dropped DLL 4 IoCs

Processes:

regsvr32.exerundll32.exe

pid	Process
3816	regsvr32.exe
3816	regsvr32.exe
5028	rundll32.exe
5028	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
111	raw.githubusercontent.com
112	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
2364	4664	WerFault.exe	135
5012	4280	WerFault.exe	146

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

DanaBot.exeDanaBot.exeregsvr32.exerundll32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 313904.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	Process
3504	msedge.exe
3504	msedge.exe
4876	msedge.exe
4876	msedge.exe
3952	identity_helper.exe
3952	identity_helper.exe
4376	msedge.exe
4376	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

msedge.exe

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4876 wrote to memory of 4808	4876	msedge.exe	83
PID 4876 wrote to memory of 4808	4876	msedge.exe	83
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 2332	4876	msedge.exe	84
PID 4876 wrote to memory of 3504	4876	msedge.exe	85
PID 4876 wrote to memory of 3504	4876	msedge.exe	85
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86
PID 4876 wrote to memory of 3216	4876	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://picshare.hair/image.php?id=RMHUD7.png
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bb5446f8,0x7ff8bb544708,0x7ff8bb544718
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1804 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4664
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\DanaBot.exe@4664
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3816
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\DanaBot.dll,f0
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 488
    3⤵
    - Program crash
    PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,6297173104210344830,6264508354762551081,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 136
    3⤵
    - Program crash
    PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4664 -ip 4664
1⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4280 -ip 4280
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7fa15002-7d6b-4a52-9c58-08f7d74eec5f.tmp

Filesize
10KB

MD5
2aaccbe546e683408909831840566632

SHA1
ce899b018fe8e7f1b013b3a06e1fc1378047479c

SHA256
4c88fbf2f1c82488ae101169de588f587b3f23430fe54e260a9a5e8f5ba3a7a9

SHA512
6d906015ee2c4b059ea54404f63f8777b221c60e74ffba6bdb113a1da4d8fac268898d51393cbc3e66cf7013683fef4fc3b78ad0c8019ac7269594e462ee6e19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
929091cd83cb969a1d06ee893798eb5d

SHA1
b2f6ca5cf5775006caf8d902af3954cbccdac9df

SHA256
e42db2cae61912903c7e7e28b706050938a49b81a695d20fa38d12bb83b309b4

SHA512
d589a01e389b0e845f46f3962f1cf9ea99abf811843dc2d5828429ca603ff9c8548ddeeebe0d3deb4e1cc65549a48d5aeaa9a2ce9cfc6150ad8d06c407330f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
321B

MD5
5c6344415e35d0f0d222277830f3d58d

SHA1
c8640d7657a4d982a2fe645baad448bddff44365

SHA256
0bccc84a883f877f186fe297fe74bb1cf349d534e4f670215b48d277a93a705f

SHA512
c352bbf3f369773cc57d455b5042b58a743fd7ef6b6cd85fcee8f9d39336531a734c053a9aa04f7008eb7e8efbec9d98b45c436d34adf37acddcec0e6f9f9bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3f9a5383930a790324e638e46c28515b

SHA1
9a65313570fb3b54e1207b05c1da1f775eab616f

SHA256
78eb640f120e4c71700573c2635b950ac1378f14c5888f5b04a82e1212c26c19

SHA512
07e5c6653e6cee2a578ee79a9ee3492ff1e7660c71eb300ee47418e48e8a7718523875025052ed6239815825f8b03d2b6b10b0c09362d8870d965c18c0c8eaa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f593c7b1ee71e5ccedcd450b48ad9b1

SHA1
c7d5a2e68cf1540ba7e5ecdb689e408c59ab3d96

SHA256
c338cfc802f76d0b3255c2ad54bef97449e1fe459c6bc4ba29642406602b7a87

SHA512
7b8a53913735edf78b70c30744de35220bcb58c2d6505a6dd5f1f7390736b223f97c08532c88de5d70d3131ff112ccd1b791ca49ec1f891d870889516bd86ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2f341eea8aeda6c51295f86b61e51058

SHA1
9da02187f1f1bd695b9bac326e9c69c12fde071b

SHA256
81824381ac83dd7bfcc2a037a8b6ed69a3579bd8b7404430fd63f6e8bec4883a

SHA512
431d18486959f5b76f98ca8662b94776d823912f08b74acc5364b7b052018bb06a2eb1c8ee860bba311c63d391e49fe0f5ed847e54ec5efb0afa1d7abfbe0cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1251cf315a7e1a7191b51138426f9872

SHA1
a83597c84b6cee1f8fb43b1041e648617598534e

SHA256
8de4fc71d412e84fe66028bd3d23e1e847a604cd2a8c7273695d6a95af1a289a

SHA512
d0fb32291ccd7afe6370ae49d08cad737e9bc5a5385cde59c6feb50c0f333a25c3b3dfe8aec892782991c438ee8c659d93fbee4047cf952cfe4de846ee2cef03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6bf8609c88e9deb4f5df1d5212a2cacc

SHA1
0e2611125ff76f735587a116f3e7c256ae4a1165

SHA256
a2d0b736dc8de1d1f1328513d70dc8e8f1268c8c6b45adb1dcf0b743e744cac9

SHA512
bd185062badbef97405b0e7e265418996f0976ce75a4b01b225ec46f6663f45cb44adc14ff44e8eb5c46913c4fa851543a5bbf1c25b0b614f25890955835c24b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5fe131da4d7efdf25774359176ebdd96

SHA1
6976689895920bbcc817dcbe85fb33e0dcd829df

SHA256
06eeaf8d9b2a3f4554b0007bc3bcdf4109c8ee52b9a51eb35f0a349885000e90

SHA512
211937665906a0556b016b31b4166626b8443da1e693d122b50571c614889b8a7ce2075d4757fbcf9921326aa9dec52829d31db80becdcf4d8d2d55d3f338217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
317451f685af14fcfeacbfe480b92b2c

SHA1
415dfee9aee4d27c6e9440f75b2937cb95740456

SHA256
bbe52ee90f9f6144baacba25e8ba361c42e74034dc9787e46ca90b98bdc35ea8

SHA512
795a1ce1a597f7570bd0eee2acefc13b0cc16418ef741e3d5c6c13b3283be0f2ececaa036214873976ce9eb4b0884924f06ab7237712965f2a3e9776ce44e77c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f862244b4bfc20d2e761e9fe7e6f0c15

SHA1
25f4d36924289011628adf78b6ca9af717801afc

SHA256
cb74f8e5fa885a5dc93344738fb37d22463239237cb033e52ea54cbc42c78a1e

SHA512
c26e6bbc6b9d0638cb42175d0c9012b84a90297223973a0fd3403f2b8f0d7b92878fa8f5d1c7578b0629d0d5e41bb928385e2a5dc0e5d32835cc1b0ebe618be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
33382e01df0abce0b87d71e00bbf3be8

SHA1
4c1e7832f43a6032ff21e7c459c7c1f8b3bacdce

SHA256
5940ae709655615cc34b79657739798a8ada6bd37be6b5e971a94104a3ec7f45

SHA512
537915b9d0a6c810555a4fbf2c493780e3b7449fa317f70106b884f783f1d180ad9496e368797a22bb3d52594e9a91faa701acb17e455b608508912d91a6ccf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe595af7.TMP

Filesize
538B

MD5
fe0077b721a295a1077cefaf3cae075b

SHA1
8284feb854edd23b34d13185480e296f2aafc0dc

SHA256
2edb943f17214b7f741b4974b404322dbe6eb22f5ddf7ace3a40a9f778118d4b

SHA512
b66c05650c4593dc058084f0c6b11126dbab919c3855d2f110d8db8c791fd5cb5b48f5e8352b02c1a204cbf6f1fa54cb38a0a53f8b52e1864c93de2ea748cbdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
60f113ddd83f52d85a38908f1d4d4c69

SHA1
3f5c7454a53b5c0782ab9e9086911f6f2e266500

SHA256
6e6d34911e383857c43c27fab8d467489e8450324923c669f0889234997ae3e4

SHA512
cd8d7f2c0ddf797a76f3aad726afd75786931751ef6d56a6a3186351a16b819aab3bfc7fba442feebeb57ba9955a236bf9a0ee1e9001aba7c643d5ef16c95919

Download Submit
C:\Users\Admin\DOWNLO~1\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 313904.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
\??\pipe\LOCAL\crashpad_4876_HOFZGHBULROZQWBP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3816-466-0x0000000002100000-0x000000000236B000-memory.dmp

Filesize
2.4MB

Download
memory/4280-506-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/4664-470-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/5028-469-0x0000000001FC0000-0x000000000222B000-memory.dmp

Filesize
2.4MB

Download
memory/5028-473-0x0000000001FC0000-0x000000000222B000-memory.dmp

Filesize
2.4MB

Download
memory/5028-495-0x0000000001FC0000-0x000000000222B000-memory.dmp

Filesize
2.4MB

Download